Allow image uploads in lesson comments

Add an image button to the comment toolbar backed by a new upload route
(images only, 5 MB, stored under comments/<userId>/), inserted as Markdown.

Only images served from our own storage are rendered: a third-party src would
be fetched by every reader of the lesson, exposing their address. Such links
are shown as plain links instead — this also defuses the external images a few
existing comments already carry.

src/app/(student)/courses/[slug]/lessons/[lessonId]/page.tsx

@@ -289,6 +289,7 @@ export default async function LessonPage({ params }: Props) {
             comments={comments}
             currentUserId={session.user.id}
             currentUserRole={session.user.role ?? "student"}
+            imageHost={process.env.S3_CDN_URL ?? ""}
           />
         </div>
       )}

src/app/api/student/comment-upload/route.ts

@@ -0,0 +1,39 @@
+import { NextRequest, NextResponse } from "next/server";
+import { headers } from "next/headers";
+import { auth } from "@/lib/auth";
+import { uploadFile } from "@/lib/s3";
+import { randomUUID } from "crypto";
+
+// Images only: comments render them inline, and anything else would just be an
+// unlabelled blob in the middle of a discussion.
+const ALLOWED_TYPES = new Set(["image/jpeg", "image/png", "image/gif", "image/webp"]);
+const ALLOWED_EXTS = new Set(["jpg", "jpeg", "png", "gif", "webp"]);
+const MAX_BYTES = 5 * 1024 * 1024; // 5 MB — enough for a screenshot
+
+export async function POST(req: NextRequest) {
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+
+  const form = await req.formData();
+  const file = form.get("file") as File | null;
+  if (!file) return NextResponse.json({ error: "Missing file" }, { status: 400 });
+
+  if (file.size > MAX_BYTES) {
+    return NextResponse.json({ error: "Изображение слишком большое (макс. 5 МБ)" }, { status: 413 });
+  }
+
+  if (!ALLOWED_TYPES.has(file.type)) {
+    return NextResponse.json({ error: "Разрешены только изображения: jpg, png, gif, webp" }, { status: 415 });
+  }
+
+  const ext = file.name.split(".").pop()?.toLowerCase() ?? "bin";
+  if (!ALLOWED_EXTS.has(ext)) {
+    return NextResponse.json({ error: "Недопустимое расширение файла" }, { status: 415 });
+  }
+
+  const key = `comments/${session.user.id}/${randomUUID()}.${ext}`;
+  const buffer = Buffer.from(await file.arrayBuffer());
+  const url = await uploadFile(key, buffer, file.type);
+
+  return NextResponse.json({ name: file.name, url, size: file.size });
+}

src/app/globals.css

@@ -243,6 +243,13 @@
 }
 
 /* Markdown-разметка в комментариях под уроками (react-markdown) */
+.comment-md img {
+  display: block;
+  max-width: 100%;
+  height: auto;
+  margin: 0.5rem 0;
+  border: 2px solid var(--border);
+}
 .comment-md > :first-child { margin-top: 0; }
 .comment-md > :last-child { margin-bottom: 0; }
 .comment-md p { margin: 0 0 0.5rem; }