feat(market): embed offer photos inline instead of a media server

Replace the Blossom media-server approach with a fully decentralized one:
generate a small (~320px) JPEG thumbnail from the lot's cover photo and
embed it in the offer event as a data: URI, so photos ride the relays with
no server and no IP leak. The full photo stays in the encrypted inventory.

- offer_thumbnail.dart: downscale-until-it-fits data-URI builder + decoder
- market_widgets: render data: URIs from memory, http(s) URLs from network
- offers_cubit: publish a thumbnail (best-effort) in place of an upload
- drop MediaTransport/Blossom from commons_core (http/crypto deps) and the
  media-server setting; parked on branch parked/offer-photos-blossom

Relay event-size limits cap the image to a thumbnail; higher-res sharing
would need the parked Blossom path.

apps/app_seeds/test/services/offer_thumbnail_test.dart

@@ -0,0 +1,61 @@
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:image/image.dart' as img;
+import 'package:tane/services/offer_thumbnail.dart';
+
+void main() {
+  /// A real, decodable photo far bigger than a thumbnail, with varied pixels so
+  /// JPEG can't compress it to nothing.
+  Uint8List bigPhoto() {
+    final image = img.Image(width: 1280, height: 960);
+    for (var y = 0; y < image.height; y++) {
+      for (var x = 0; x < image.width; x++) {
+        image.setPixelRgb(x, y, (x * 7) % 256, (y * 5) % 256, (x + y) % 256);
+      }
+    }
+    return img.encodeJpg(image, quality: 90);
+  }
+
+  test('produces a small jpeg data-URI that fits the byte budget', () {
+    final uri = offerThumbnailDataUri(bigPhoto(), maxBytes: 40000);
+
+    expect(uri, isNotNull);
+    expect(uri!, startsWith('data:image/jpeg;base64,'));
+    final b64 = uri.substring('data:image/jpeg;base64,'.length);
+    expect(b64.length, lessThanOrEqualTo(40000));
+
+    // The payload really is a smaller image than the source.
+    final decoded = img.decodeJpg(base64.decode(b64))!;
+    expect(decoded.width, lessThanOrEqualTo(320));
+    expect(decoded.height, lessThanOrEqualTo(320));
+  });
+
+  test('never upscales an already-tiny image', () {
+    final small = img.encodeJpg(img.Image(width: 64, height: 48), quality: 80);
+    final uri = offerThumbnailDataUri(small);
+
+    expect(uri, isNotNull);
+    final b64 = uri!.substring('data:image/jpeg;base64,'.length);
+    final decoded = img.decodeJpg(base64.decode(b64))!;
+    expect(decoded.width, 64);
+    expect(decoded.height, 48);
+  });
+
+  test('returns null for bytes that are not an image', () {
+    expect(offerThumbnailDataUri(Uint8List.fromList([1, 2, 3, 4])), isNull);
+  });
+
+  group('decodeDataUri', () {
+    test('round-trips a base64 data URI to its bytes', () {
+      final bytes = Uint8List.fromList([9, 8, 7, 6]);
+      final uri = 'data:image/jpeg;base64,${base64.encode(bytes)}';
+      expect(decodeDataUri(uri), bytes);
+    });
+
+    test('returns null for a plain http url', () {
+      expect(decodeDataUri('https://example.org/a.jpg'), isNull);
+    });
+  });
+}

apps/app_seeds/test/services/social_settings_test.dart

@@ -27,15 +27,6 @@ void main() {
     expect(await settings.relayUrls(), isEmpty);
   });
 
-  test('media server defaults, is configurable, and can be turned off',
-      () async {
-    expect(await settings.mediaServerUrl(), SocialSettings.defaultMediaServer);
-    await settings.setMediaServerUrl('  https://blossom.example  ');
-    expect(await settings.mediaServerUrl(), 'https://blossom.example');
-    await settings.setMediaServerUrl(''); // explicit empty = no photo hosting
-    expect(await settings.mediaServerUrl(), '');
-  });
-
   test('stores and normalises the area geohash (trim + lowercase)', () async {
     await settings.setAreaGeohash('  SP3E9  ');
     expect(await settings.areaGeohash(), 'sp3e9');

apps/app_seeds/test/state/offers_cubit_test.dart

@@ -41,24 +41,6 @@ class FakeOfferTransport implements OfferTransport {
   Future<void> close() async {}
 }
 
-/// In-memory [MediaTransport]: hands back a fixed URL, or throws when [fail] is
-/// set (to prove the publish step degrades to no-image instead of erroring).
-class FakeMediaTransport implements MediaTransport {
-  FakeMediaTransport({this.fail = false});
-  final bool fail;
-  int uploads = 0;
-
-  @override
-  Future<Uri> upload(Uint8List bytes, {required String mimeType}) async {
-    uploads++;
-    if (fail) throw const MediaUploadException('boom', 500);
-    return Uri.parse('https://media.test/hosted.jpg');
-  }
-
-  @override
-  Future<void> close() async {}
-}
-
 /// Emits every published offer TWICE on discover — the way a relay legitimately
 /// resends an addressable event (a stored copy plus a live echo). Used to prove
 /// the cubit dedups instead of doubling the listing.
@@ -312,14 +294,17 @@ void main() {
       await cubit.close();
     });
 
-    test('publishLots hosts the cover photo and puts its URL on the offer',
+    test('publishLots embeds an inline thumbnail data-URI on the offer',
         () async {
       final transport = FakeOfferTransport();
-      final media = FakeMediaTransport();
+      var thumbnailed = 0;
       final cubit = OffersCubit(
         transport,
-        media: media,
         coverPhoto: (id) async => Uint8List.fromList([1, 2, 3]),
+        thumbnail: (bytes) {
+          thumbnailed++;
+          return 'data:image/jpeg;base64,AAAA';
+        },
       );
       await cubit.publishLots(
         const [
@@ -336,18 +321,18 @@ void main() {
 
       await cubit.discover('sp3');
       await pumpEventQueue();
-      expect(media.uploads, 1);
-      expect(cubit.state.offers.single.imageUrl, 'https://media.test/hosted.jpg');
+      expect(thumbnailed, 1);
+      expect(cubit.state.offers.single.imageUrl, 'data:image/jpeg;base64,AAAA');
       await cubit.close();
     });
 
-    test('publishLots still publishes (without image) when hosting fails',
+    test('publishLots still publishes (without image) when thumbnailing fails',
         () async {
       final transport = FakeOfferTransport();
       final cubit = OffersCubit(
         transport,
-        media: FakeMediaTransport(fail: true),
         coverPhoto: (id) async => Uint8List.fromList([1, 2, 3]),
+        thumbnail: (bytes) => throw Exception('boom'),
       );
       final count = await cubit.publishLots(
         const [
@@ -369,9 +354,9 @@ void main() {
       await cubit.close();
     });
 
-    test('publishLots without a media server publishes no image', () async {
+    test('publishLots without a thumbnailer publishes no image', () async {
       final transport = FakeOfferTransport();
-      final cubit = OffersCubit(transport); // no media, no coverPhoto
+      final cubit = OffersCubit(transport); // no thumbnail, no coverPhoto
       await cubit.publishLots(
         const [
           ShareableLot(

apps/app_seeds/test/ui/market_widgets_test.dart

@@ -4,7 +4,24 @@ import 'package:tane/ui/market_widgets.dart';
 
 Widget _wrap(Widget child) => MaterialApp(home: Scaffold(body: Center(child: child)));
 
+/// A 1×1 PNG as an inline data URI — the shape offers actually publish.
+const _dataUri =
+    'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lE'
+    'QVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==';
+
 void main() {
+  testWidgets('OfferThumbnail renders an inline data-URI from memory',
+      (tester) async {
+    await tester.pumpWidget(
+      _wrap(const OfferThumbnail(url: _dataUri, semanticLabel: 'Photo')),
+    );
+    await tester.pump();
+
+    expect(find.byType(Image), findsOneWidget);
+    // Decoded fine — no broken-image placeholder.
+    expect(find.byIcon(Icons.image_not_supported_outlined), findsNothing);
+  });
+
   testWidgets('OfferThumbnail builds a network image', (tester) async {
     await tester.pumpWidget(
       _wrap(const OfferThumbnail(