feat(commons_core): Blossom MediaTransport for offer photos

Add a MediaTransport interface (sibling of Offer/Message/Trust transports)
and a Blossom (BUD-01/02) backend: sign a kind-24242 upload auth with the
same secp256k1 identity, PUT the bytes over HTTP, return the content-
addressed URL. Idempotent by SHA-256; http.Client injected for tests.

packages/commons_core/test/social/blossom_media_transport_test.dart

@@ -0,0 +1,90 @@
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:commons_core/commons_core.dart';
+import 'package:crypto/crypto.dart' as crypto;
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+import 'package:nostr/nostr.dart';
+import 'package:test/test.dart';
+
+void main() {
+  Future<String> secretKey() async {
+    final id = await NostrKeyDerivation.deriveFromSeed(
+      Uint8List(32)..fillRange(0, 32, 7),
+    );
+    return id.privateKeyHex;
+  }
+
+  final bytes = Uint8List.fromList(List<int>.generate(64, (i) => i));
+  final sha = crypto.sha256.convert(bytes).toString();
+
+  test('PUTs to /upload with a signed kind-24242 auth and returns the url',
+      () async {
+    late http.Request captured;
+    final client = MockClient((req) async {
+      captured = req;
+      return http.Response(
+        json.encode({'url': 'https://media.test/$sha.jpg', 'sha256': sha}),
+        200,
+      );
+    });
+    final transport = BlossomMediaTransport(
+      Uri.parse('https://media.test'),
+      await secretKey(),
+      client: client,
+    );
+
+    final url = await transport.upload(bytes, mimeType: 'image/jpeg');
+
+    expect(url, Uri.parse('https://media.test/$sha.jpg'));
+    expect(captured.method, 'PUT');
+    expect(captured.url, Uri.parse('https://media.test/upload'));
+    expect(captured.bodyBytes, bytes);
+    expect(captured.headers['content-type'], startsWith('image/jpeg'));
+
+    // The Authorization header is a base64 Nostr event; decode and inspect it.
+    final header = captured.headers['authorization']!;
+    expect(header, startsWith('Nostr '));
+    final event = Event.fromMap(
+      json.decode(utf8.decode(base64.decode(header.substring(6))))
+          as Map<String, dynamic>,
+      verify: true, // a real Schnorr signature over the canonical id
+    );
+    expect(event.kind, BlossomMediaTransport.authKind);
+    String? tag(String name) => event.tags
+        .firstWhere((t) => t.isNotEmpty && t[0] == name, orElse: () => const [])
+        .elementAtOrNull(1);
+    expect(tag('t'), 'upload');
+    expect(tag('x'), sha);
+    expect(tag('expiration'), isNotNull);
+  });
+
+  test('falls back to <server>/<sha256> when the body carries no url', () async {
+    final client = MockClient((req) async => http.Response('', 200));
+    final transport = BlossomMediaTransport(
+      Uri.parse('https://media.test/'),
+      await secretKey(),
+      client: client,
+    );
+
+    final url = await transport.upload(bytes, mimeType: 'image/jpeg');
+
+    expect(url, Uri.parse('https://media.test/$sha'));
+  });
+
+  test('throws MediaUploadException on a non-2xx response', () async {
+    final client = MockClient((req) async => http.Response('nope', 413));
+    final transport = BlossomMediaTransport(
+      Uri.parse('https://media.test'),
+      await secretKey(),
+      client: client,
+    );
+
+    expect(
+      () => transport.upload(bytes, mimeType: 'image/jpeg'),
+      throwsA(isA<MediaUploadException>()
+          .having((e) => e.statusCode, 'statusCode', 413)),
+    );
+  });
+}