feat: implement CMS for content management (WEB-02/03/04/06)

Introduces Filament management for site settings, services, portfolio cases, and testimonials with admin-only policies, validated media uploads, and deterministic seeding. Includes comprehensive design and task documentation for the implementation.

Co-authored-by: Cursor <cursoragent@cursor.com>

openspec/changes/archive/2026-07-29-build-content-cms/specs/content-media/spec.md

@@ -0,0 +1,32 @@
+## ADDED Requirements
+
+### Requirement: Public content images are validated and stored securely
+
+The system SHALL validate public content uploads (service covers, portfolio covers/gallery, testimonial photos, site OG image) per SPEC §6.4 and §12.4. Validation MUST enforce MIME allowlist (jpeg, png, webp), matching extensions, maximum size of 10 MB, and mandatory alt text when an image is uploaded.
+
+#### Scenario: Invalid MIME is rejected
+
+- **WHEN** an admin uploads a file with disallowed MIME type
+- **THEN** validation MUST fail with a pt-BR error message
+
+#### Scenario: Oversized file is rejected
+
+- **WHEN** an admin uploads an image exceeding 10 MB
+- **THEN** validation MUST fail
+
+#### Scenario: Storage path is not derived from original filename
+
+- **WHEN** an image is stored
+- **THEN** the physical path MUST be generated (UUID/hash based)
+- **AND** MUST NOT use the original upload filename as the storage key
+
+#### Scenario: Alt text required with image
+
+- **WHEN** an admin uploads a cover or gallery image without alt text
+- **THEN** validation MUST fail
+
+#### Scenario: Images are not stored in PostgreSQL
+
+- **WHEN** content with images is persisted
+- **THEN** only the filesystem path MUST be stored in the database
+- **AND** binary image data MUST NOT be written to PostgreSQL columns