Project create/list API, clip uploads, CORS, public read

- Project gains a clip FileField; POST /api/projects/ creates one from an
  uploaded otio + clip (<=100 MB), owned by the requester
- add /api/me/ and project-detail; scene GET is public (view without login),
  PUT stays owner/collaborator-only
- serve media in DEBUG (range requests for video seek); CORS for the cljs dev
  origin with credentials
- seed_demo now builds the Challengers project from the bundled otio + 480p clip

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/settings.py

@@ -37,10 +37,12 @@ INSTALLED_APPS = [
     'django.contrib.sessions',
     'django.contrib.messages',
     'django.contrib.staticfiles',
+    'corsheaders',
     'scenes',
 ]
 
 MIDDLEWARE = [
+    'corsheaders.middleware.CorsMiddleware',
     'django.middleware.security.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
     'django.middleware.common.CommonMiddleware',
@@ -117,8 +119,16 @@ USE_TZ = True
 
 STATIC_URL = 'static/'
 
-# Uploaded OTIO files
+# Uploaded OTIO + clip files
 MEDIA_URL = 'media/'
 MEDIA_ROOT = BASE_DIR / 'media'
 
+# Allow clip uploads up to ~100 MB (files stream to a temp file past 2.5 MB).
+DATA_UPLOAD_MAX_MEMORY_SIZE = 100 * 1024 * 1024
+
+# The shadow-cljs dev frontend talks to this API cross-origin, with the session
+# cookie, so allow its origin + credentials.
+CORS_ALLOWED_ORIGINS = ['http://localhost:8280', 'http://127.0.0.1:8280']
+CORS_ALLOW_CREDENTIALS = True
+
 DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'

server/urls.py

@@ -1,4 +1,6 @@
 """URL configuration for the scene_analysis backend."""
+from django.conf import settings
+from django.conf.urls.static import static
 from django.contrib import admin
 from django.urls import include, path
 
@@ -6,3 +8,7 @@ urlpatterns = [
     path("admin/", admin.site.urls),
     path("api/", include("scenes.urls")),
 ]
+
+# Serve uploaded OTIO/clip files in development (supports HTTP range → video seek).
+if settings.DEBUG:
+    urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)