feat(privacy): strip EXIF/XMP/IPTC from image uploads by default (#109)

Metadata was only dropped as a side effect of opt-in compression, so a
phone photo carried its GPS fix, camera model and timestamp into the room
and the media store. utils/stripImageMetadata.ts now removes it at the
container level, without touching pixels: JPEG drops APP1/APP13/COM
(writing back a minimal EXIF holding only Orientation when it isn't 1,
so sideways-stored photos still display upright), PNG drops eXIf and the
text chunks XMP lives in, WebP drops EXIF/XMP and clears the VP8X flags.
Other types pass through.

Applied before encryption on every composer path (attach, paste, drop,
share target) and to user/room avatar picks; GIF upload is excluded.
Setting → General → Privacy "Remove Photo Metadata Before Sending",
default on. The upload card says "Photo metadata removed".

Unit tests on generated fixtures with a GPS IFD (JPEG orientation 6,
JPEG + comment, PNG with eXIf + XMP, WebP with EXIF); verified end to
end: the bytes stored by Synapse decode fine and carry only Orientation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/app/state/room/roomInputDrafts.ts

@@ -15,6 +15,8 @@ export type TUploadMetadata = {
   compressImage?: boolean;
   /** Cached compression result (populated in the background when compressImage is set to true) */
   compressionResult?: CompressionResult | null;
+  /** [Gitea #109] EXIF/XMP/IPTC was removed from this image before upload. */
+  metadataStripped?: boolean;
 };
 
 export type TUploadItem = {

src/app/state/settings.ts

@@ -268,6 +268,9 @@ export interface Settings {
   // [Gitea #103] Remove utm_/fbclid/… tracking params from links you paste or
   // send, and from links rendered in the timeline. Local only.
   stripTrackingParams: boolean;
+  // [Gitea #109] Drop EXIF/XMP/IPTC (GPS, camera, timestamp) from JPEG/PNG/WebP
+  // uploads without re-encoding. Default on.
+  stripImageMetadata: boolean;
 
   // [Gitea #104] Mirror user preferences to `io.lotus.settings` account data
   // so other devices pick them up. Device-local itself (utils/settingsSync).
@@ -390,6 +393,7 @@ const defaultSettings: Settings = {
   warnOnUnverifiedDevices: false,
 
   stripTrackingParams: true,
+  stripImageMetadata: true,
 
   settingsSync: true,