R5 the server's own settings: instance, rules, announcements, relays, media limits, the staff's log

A singleton ServerSettings (title, descriptions, contact, thumbnail, privacy policy, terms, rules, relays, media
overrides, PublishActivity), cached by InstanceSettings and read by the instance API, NodeInfo, the instance actor, the
web pages and the mailer; its defaults are the old literals, so nothing changes until an administrator edits.
/clientapi/admin/settings (and /thumbnail), /announcements, /relays for administrators; /clientapi/moderator/log, the
staff's log (AdminAction, written by domain blocks, backups, settings and the CLI; no IP, never a root paired with its
personas). The Mastodon API's rules, extended description, privacy policy, terms of service, domain blocks (Published,
Obfuscate), announcements (dismiss, reactions, streaming) and activity (only when published). Reports carry rule ids.
Media overrides clamped to hard caps. Relays named by the settings reconcile next to the configured ones.

Verified: interop.sh instance accounts relay with mastodon, relay, aoderelay and mailpit, 119 passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Domain/Media/MediaAudit.cs

@@ -9,7 +9,8 @@ namespace PrivaPub.Domain.Media
 {
 	// What the media directory holds against what the database says holds it, and, with fix, the two made to agree:
 	// - a persona's current avatar or header with no row (they had none before) becomes a row of its own;
-	// - media of a deleted post or of a deleted persona go to the trash;
+	// - media of a deleted post or of a deleted persona go to the trash, and a picture of the server's own (ServerUse) that
+	//   its settings no longer name;
 	// - rows whose files are gone go to the trash;
 	// - files nothing holds (deleted posts' media and replaced pictures, from before media were trashed) get a trashed row
 	//   each.
@@ -59,7 +60,11 @@ namespace PrivaPub.Domain.Media
 			var ownerIds = rows.Select(r => r.OwnerAvatarId).Where(id => id != null).Distinct().ToList();
 			var liveOwners = (await DB.Default.Find<Avatar>().Match(a => ownerIds.Contains(a.ID) && !a.DeletionAt.HasValue).Project(a => a.Include(x => x.ID)).ExecuteAsync(token))
 				.Select(a => a.ID).ToHashSet();
-			var ofDeleted = rows.Where(r => (r.PostId != null && !livePosts.Contains(r.PostId)) || (r.OwnerAvatarId != null && !liveOwners.Contains(r.OwnerAvatarId))).ToList();
+			// (the server's own pictures belong to nobody: they are held while the settings name them)
+			var settings = await DB.Default.Find<Models.ServerSettings>().Match(x => x.ID == Models.ServerSettings.Name).ExecuteFirstAsync(token);
+			var serverHeld = new HashSet<string> { settings?.ThumbnailMediaId };
+			var ofDeleted = rows.Where(r => r.ServerUse != null ? !serverHeld.Contains(r.ID)
+				: (r.PostId != null && !livePosts.Contains(r.PostId)) || (r.OwnerAvatarId != null && !liveOwners.Contains(r.OwnerAvatarId))).ToList();
 			var missing = rows.Except(ofDeleted).Where(r => !string.IsNullOrEmpty(r.FilePath) && !files.Contains(r.FilePath)).ToList();
 			if (fix)
 				foreach (var row in ofDeleted.Concat(missing))