journal: paste image from clipboard, cap embedded image size, fix media persistence

- Paste-to-embed: pasting an image into the markdown editor uploads it and
  inserts ![](url) at the cursor. Unlike gallery attachments these aren't
  tied to a journal_entry (the entry may not exist yet while composing), so
  they're stored per-user under app/media/journal/{user_id}/pasted/ with no
  DB row, served through an ownership-scoped route, and never cleaned up
  automatically when an entry is deleted -- an accepted tradeoff at this
  app's personal scale.
- The markdown sanitizer was stripping all <img> tags (not on the bleach
  allowlist), which would have silently deleted every pasted image on save;
  added img/src/alt/title while keeping event-handler attributes blocked.
- Cap embedded image width in both the editor pane and the rendered preview
  so a large pasted photo can't overflow its card.
- Fix real data loss risk found while testing this: docker-compose.yml had
  no volume for app/media, so every container recreate during a deploy wiped
  uploaded photos, and deploy_sftp.py was syncing app/media/ (runtime user
  data, not source) into the remote build context. Added the volume mount
  and excluded media/ from the sync script. Recovered and relocated the
  real attachments that had already landed in the wrong place on the NAS
  during earlier deploys this session.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/markdown_utils.py

@@ -10,9 +10,9 @@ _ALLOWED_TAGS = [
     "p", "br", "strong", "em", "del",
     "h1", "h2", "h3", "h4",
     "ul", "ol", "li",
-    "blockquote", "code", "pre", "hr", "a",
+    "blockquote", "code", "pre", "hr", "a", "img",
 ]
-_ALLOWED_ATTRS = {"a": ["href", "title"]}
+_ALLOWED_ATTRS = {"a": ["href", "title"], "img": ["src", "alt", "title"]}
 
 
 def render_markdown(text: str) -> Markup: