feat(news-portal): add content quality checklist with R2 image requirements #640

Depends on: #631, #632, #633, #634, #635, #636

Context

News portal content needs editorial and SEO quality checks before publishing. In full-online R2-only mode, the quality checklist must also verify that public news images are stored as verified Cloudflare R2 media objects.

Objective

Add a content quality checklist for news portal publishing with R2 image requirements.

Scope

Add checklist rules for:

• Title is present.
• Slug is valid.
• Excerpt is present.
• Meta description is present.
• Featured image exists.
• Featured image references a verified R2 media object.
• Featured image has alt text.
• Image width/height metadata exists.
• MIME type is allowed.
• File size is within policy.
• og:image comes from trusted R2 media metadata.
• No local image path exists in content_json.
• No arbitrary external image URL exists in news image blocks.
• Gallery images reference verified R2 media objects.
• Category/taxonomy exists.
• Unsafe HTML/script/embed is rejected.
• Scheduled publish time is valid.

Rule severity:

blocking
warning
info

Suggested default blocking rules:

• Unsafe HTML/script/embed.
• Local image path in full-online R2-only mode.
• Arbitrary external image URL for news image.
• Missing or unverified featured image when tenant policy requires it.
• Cross-tenant media object reference.

Out of scope

• AI writing assistant.
• Plagiarism checker.
• External SEO scoring API.
• Importing legacy content.
• Offline/LAN-specific checklist.

Acceptance criteria

• Checklist is available in admin post/page editor.
• Publish API returns checklist result with blockers and warnings.
• Publish is blocked when critical R2 media requirements fail.
• Publish is blocked when content contains local image paths in full-online R2-only mode.
• Publish is blocked when content contains arbitrary external image URLs for news images.
• Warning is returned when alt text is missing, unless tenant policy makes it blocking.
• Tenant policy can configure warning vs blocking for selected non-security rules.
• Audit log records publish attempts blocked by checklist.
• Tests cover blocking rules, warning rules, tenant policy override, R2 verification, local path rejection, external URL rejection, and unsafe HTML rejection.
• OpenAPI is updated if API response shape changes.
• bun run api:spec:check passes where applicable.
• bun run test passes.
• bun run build passes.
• bun run check passes.

Security notes

• Security blockers must not be downgraded by tenant policy in production.
• Do not rely on client-side checklist only.
• Validate server-side before state transition to published/scheduled.