iOS-Voll-App M0: Media-Registry (iCloud-Hybrid) — Originale in Nutzer-CloudKit, Server nur Previews: POST/PATCH/GET /api/media (register/confirm/mine/original-Fallback), Phantom-URL+iCloud-404 in serve_media, Registry-Cleanup in Delete-Pfaden, media_items mit storage+ck_record_name; Datenschutz v5 (CloudKit); Fixes: daily_photo_cache in zentrale Migration (Löschen warf auf frischer DB 500), Preview/Thumb-Leichen beim Medium-Löschen; 9 neue Tests, Suite 73 grün

backend/main.py

@@ -237,6 +237,7 @@ from routes.wiki       import router as wiki_router
 from routes.movies     import router as movies_router
 from routes.friends    import router as friends_router
 from routes.chat       import router as chat_router
+from routes.media      import router as media_router
 from routes.admin       import router as admin_router
 from routes.webcal      import router as webcal_router
 from routes.profile     import router as profile_router
@@ -306,6 +307,7 @@ app.include_router(wiki_router,       prefix="/api/wiki",       tags=["Wiki"])
 app.include_router(movies_router,     prefix="/api/movies",     tags=["Filme"])
 app.include_router(friends_router,    prefix="/api/friends",    tags=["Freunde"])
 app.include_router(chat_router,       prefix="/api/chat",       tags=["Chat"])
+app.include_router(media_router,      prefix="/api/media",      tags=["Medien"])
 app.include_router(admin_router,      prefix="/api/admin",      tags=["Admin"])
 app.include_router(breeder_router,    prefix="/api",            tags=["Züchter"])
 app.include_router(litters_router,         prefix="/api",       tags=["Würfe"])
@@ -583,6 +585,22 @@ async def serve_media(path: str, request: _Request):
 
     filepath = _resolve_media_path(path)
     if not filepath:
+        # iCloud-Hybrid (M0): Original liegt in der privaten iCloud des Besitzers,
+        # auf dem Server existiert nur das Preview. Marker-404, damit Clients
+        # unterscheiden können — Web fällt via onerror aufs Preview zurück.
+        # Lookup nur im Miss-Pfad → keine Kosten für normale Medien-Requests.
+        from database import db as _db
+        from fastapi.responses import JSONResponse as _JSONResponse
+        with _db() as conn:
+            reg = conn.execute(
+                "SELECT storage FROM media_registry WHERE url=?", ("/media/" + path,)
+            ).fetchone()
+        if reg and reg["storage"] == "icloud":
+            return _JSONResponse(
+                {"detail": "Original liegt in der iCloud des Besitzers.",
+                 "storage": "icloud"},
+                status_code=404,
+            )
         raise _HE(404, "Nicht gefunden.")
     return _media_response(filepath)