document media hosting in readme and usecases

USECASES.md

@@ -62,9 +62,10 @@ From your dev machine (single command):
    - `.gitea/workflows/deploy-example.com.yml`
    - `docker/nginx/conf.d/example.com.conf` (HTTP->HTTPS, bare->www, proxy)
 7. SSHes to server as deploy user, issues SSL cert via webroot (zero downtime)
-8. Commits and pushes hantim-server (triggers deploy)
-9. Triggers initial build of the app repo via Gitea API
-10. Polls `https://www.example.com` until it responds (up to 3 minutes)
+8. Creates Garage media bucket via admin API (create, allow media-key, enable website)
+9. Commits and pushes hantim-server (triggers deploy)
+10. Triggers initial build of the app repo via Gitea API
+11. Polls `https://www.example.com` until it responds (up to 3 minutes)
 
 After the site is live, clone the app repo and customize:
 
@@ -148,3 +149,30 @@ triggers automatically.
 - Existing certs are skipped
 - Brief nginx downtime (seconds) while certbot checks run
 - Services are restarted
+
+## 8. Upload media files
+
+Media files (images, videos) are stored in Garage and served at `/media/`
+on each domain.
+
+```bash
+# One-time setup
+aws configure  # key ID + secret from bws, region: garage
+aws configure set default.endpoint_url https://s3.hantim.net
+
+# Upload a single file
+aws s3 cp photo.jpg s3://example.com/photo.jpg
+
+# Sync a directory
+aws s3 sync static/media/ s3://example.com/
+```
+
+**What happens:**
+1. File is uploaded to the Garage S3 API via `s3.hantim.net`
+2. Garage replicates the file to both nodes (hantim + argento)
+3. File is accessible at `https://www.example.com/media/photo.jpg`
+
+**Local development:** Store media in `static/media/` (gitignored). The app's
+nginx serves these locally, matching the `/media/` path used in production.
+
+**Reference in HTML:** Use absolute paths like `/media/photo.jpg`.