feat(news-media): add pending/orphan R2 media lifecycle cleanup and reconciliation #690

Parent epic: #679
Related news portal epic: #631

Context

News media uses full-online R2-only flows and readiness/TTL concepts, but the audit did not find a complete pending/orphan object cleanup and reconciliation job.

Objective

Prevent abandoned uploads, orphan objects, and database/object-store drift without introducing local filesystem fallback or database binary storage.

Scope

• Define pending upload TTL and object states.
• Add dry-run-first reconciliation comparing safe DB metadata with R2 object metadata.
• Delete/mark abandoned pending objects in bounded batches with locks and audit summaries.
• Detect missing referenced objects and surface operator-safe remediation status.
• Add retry/backoff/timeout behavior and provider-outage handling.
• Integrate with the shared worker runner when available.

Guardrails

• Active only for the existing full-online R2 news-media feature gate.
• No local media fallback and no binary payload in PostgreSQL.
• Never log signed URLs, credentials, or object contents.

Acceptance criteria

• Dry run makes no mutation and reports categorized counts.
• Cleanup never removes a currently referenced/active object.
• Reruns are idempotent.
• Provider outage fails safely and does not block unrelated local operations.
• Tests cover race, partial upload, missing object, pagination, and retry.
• Operator SOP and retention/privacy notes are updated.