Admin OP Phase 2: Media facet + Freshness report header

[jung-thomas]

Tutorials Admin OP — Phase 2: Media facet + Freshness report header

Adds object-store visibility and freshness run-history to the Tutorials admin Object Page. Builds on Phase 1 (#2088, merged).

Spec: docs/superpowers/specs/2026-08-31-tutorials-admin-op-enhancements-design.md (§WS5)
Plan: docs/superpowers/plans/2026-08-31-tutorials-admin-op-phase2-media-freshness.md

What changed (6 TDD tasks)

Media facet (images + assets)

• New byteSize : Integer64 on TutorialImages + TutorialAssets, persisted at ingest (buffer.length) in both stores (image-store.cjs, attachment-store.cjs) + both ingest handlers.
• Read-only AdminService projections of both entities (@readonly @cds.redirection.target: false) + Tutorials.images/assets associations joined on slug and channel='prod' (no QA-channel leak). The content Attachments composition auto-exposes → native Fiori download link.
• Two Object Page facets (Images / Assets) with sourceUrl (GitHub link via DataFieldWithUrl), mimeType, byteSize, contentHash, channel (+ filename for assets).

Freshness report header

• Tutorials.freshnessReports association + a "Freshness Reports" facet (runAt / status / model / cost / openHighCount / error) sorted newest-first via @UI.PresentationVariant.

Deployment safety (verified)

TutorialImages/TutorialAssets are live prod .hdbtable entities — this PR deliberately does not journal them, so byteSize deploys as a safe HDI auto-ALTER TABLE ADD (no .hdbmigrationtable, no db/last-dev/csn.json change → the cds-build-staging check stays green). An early attempt that journaled them (a deploy hazard) was caught and reverted during review.

D1 (no object-store binding in mta.yaml) remains a separate ops task — the Media facet renders regardless of backing store. D2: byteSize only; width/height deferred.

Review

Subagent-driven: per-task review + a final Opus whole-branch review — clean, no Critical/Important, deployment-safety items explicitly verified. Unit tests: 5 new files / 9 tests green. The media-exposure hybrid guard is deferred to a bound HANA env (run post-deploy).

Follow-ups (non-blocking)

• Legacy media rows show blank byteSize until next (re)ingest — expected ("captured at ingest").
• byteSize renders as a raw Int64 number (no unit formatting) — cosmetic.

Not in this PR

Phase 3 (Knowledge-Graph facet) plan is written and ready to execute next.