feat(privacy): strip EXIF/XMP/IPTC from image uploads by default (#109)

Metadata was only dropped as a side effect of opt-in compression, so a
phone photo carried its GPS fix, camera model and timestamp into the room
and the media store. utils/stripImageMetadata.ts now removes it at the
container level, without touching pixels: JPEG drops APP1/APP13/COM
(writing back a minimal EXIF holding only Orientation when it isn't 1,
so sideways-stored photos still display upright), PNG drops eXIf and the
text chunks XMP lives in, WebP drops EXIF/XMP and clears the VP8X flags.
Other types pass through.

Applied before encryption on every composer path (attach, paste, drop,
share target) and to user/room avatar picks; GIF upload is excluded.
Setting → General → Privacy "Remove Photo Metadata Before Sending",
default on. The upload card says "Photo metadata removed".

Unit tests on generated fixtures with a GPS IFD (JPEG orientation 6,
JPEG + comment, PNG with eXIf + XMP, WebP with EXIF); verified end to
end: the bytes stored by Synapse decode fine and carry only Orientation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/app/utils/uploadItems.ts

@@ -3,20 +3,44 @@ import { TUploadItem } from '../state/room/roomInputDrafts';
 import { encryptFile } from './matrix';
 import { safeFile } from './mimeTypes';
 import { fulfilledPromiseSettledResult } from './common';
+import { stripImageMetadata } from './stripImageMetadata';
 
 /**
  * Files → composer upload items for `room`, encrypting first when the room
  * is E2EE. Shared by the composer's pick/drop/paste paths and the PWA share
  * target (#155).
  */
-export async function filesToUploadItems(room: Room, files: File[]): Promise<TUploadItem[]> {
-  const safeFiles = files.map(safeFile);
-  const metadata = { markedAsSpoiler: false };
+export async function filesToUploadItems(
+  room: Room,
+  files: File[],
+  stripMetadata = true,
+): Promise<TUploadItem[]> {
+  const prepared = await Promise.all(
+    files.map(async (raw) => {
+      const f = safeFile(raw);
+      // [Gitea #109] Drop EXIF/XMP/IPTC before anything else sees the bytes
+      // (including encryption), so what's uploaded never carried them.
+      const { file, stripped } = stripMetadata
+        ? await stripImageMetadata(f)
+        : { file: f, stripped: false };
+      return {
+        file,
+        metadata: { markedAsSpoiler: false, metadataStripped: stripped || undefined },
+      };
+    }),
+  );
   if (room.hasEncryptionStateEvent()) {
     const encrypted = fulfilledPromiseSettledResult(
-      await Promise.allSettled(safeFiles.map((f) => encryptFile(f))),
+      await Promise.allSettled(
+        prepared.map(async ({ file, metadata }) => ({ ...(await encryptFile(file)), metadata })),
+      ),
     );
-    return encrypted.map((ef) => ({ ...ef, metadata }));
+    return encrypted;
   }
-  return safeFiles.map((f) => ({ file: f, originalFile: f, encInfo: undefined, metadata }));
+  return prepared.map(({ file, metadata }) => ({
+    file,
+    originalFile: file,
+    encInfo: undefined,
+    metadata,
+  }));
 }