fix(content): owner never pays for their own files; purchased serves from cache

- serve_content takes owner_session: a validated operator session skips the
  availability/paid gates (Availability::Nobody stays delisted); the cookie
  is re-validated in the content handler, same discipline as the model proxy
- the Tor proxy serves already-purchased items from the local content_owned
  cache with Range slicing (206) instead of re-hitting the seller's 402 —
  the buyer-side store exists so an owned item is never bought twice, and
  its cards were rendering as permanent placeholders
- adapter: 'own'-scope items never render locked (a locked card suppresses
  the playable URL — the placeholder-only grid the operator reported)
- broker: normalize 'purchased' OwnedRpcItems per item with the seller's
  onion, and group 'peers' items per seller onion, so buildMediaUrl gets a
  peerOnion and card URLs stop coming out empty

Co-Authored-By: Claude <noreply@anthropic.com>

core/archipelago/src/api/handler/proxy.rs

@@ -225,6 +225,53 @@ impl ApiHandler {
             return bad("invalid onion or content id");
         }
 
+        // Already purchased? Serve the local cache — no network, no
+        // re-payment. The seller's node charges every fetch by design; the
+        // buyer-side store (content_owned) exists precisely so an owned item
+        // never has to be bought twice, and the content surface's cards were
+        // hitting the seller's 402 and rendering as permanent placeholders.
+        // Range is honoured by slicing, so seek/playback works from cache.
+        if crate::content_owned::is_owned(&self.config.data_dir, onion, content_id).await {
+            if let Some((mime_type, bytes)) =
+                crate::content_owned::read_owned(&self.config.data_dir, onion, content_id).await
+            {
+                let total = bytes.len();
+                let range = headers
+                    .get("range")
+                    .and_then(|v| v.to_str().ok())
+                    .and_then(crate::content_server::parse_range_header);
+                if let Some(r) = range {
+                    let start = (r.start as usize).min(total);
+                    let end = r
+                        .end
+                        .map(|e| e as usize)
+                        .unwrap_or(total.saturating_sub(1))
+                        .min(total.saturating_sub(1));
+                    if start <= end && total > 0 {
+                        let slice = &bytes[start..=end];
+                        return Ok(Response::builder()
+                            .status(StatusCode::PARTIAL_CONTENT)
+                            .header("Content-Type", mime_type)
+                            .header("Content-Length", slice.len().to_string())
+                            .header("Content-Range", format!("bytes {}-{}/{}", start, end, total))
+                            .header("Accept-Ranges", "bytes")
+                            .body(hyper::Body::from(slice.to_vec()))
+                            .unwrap_or_else(|_| Response::new(hyper::Body::empty())));
+                    }
+                }
+                return Ok(Response::builder()
+                    .status(StatusCode::OK)
+                    .header("Content-Type", mime_type)
+                    .header("Content-Length", total.to_string())
+                    .header("Accept-Ranges", "bytes")
+                    .body(hyper::Body::from(bytes))
+                    .unwrap_or_else(|_| Response::new(hyper::Body::empty())));
+            }
+            // Indexed as owned but bytes missing — fall through to the peer
+            // rather than erroring: the seller can still serve it (for the
+            // price already paid, the operator can re-fetch and re-cache).
+        }
+
         let fips_npub = crate::federation::fips_npub_for_onion(&self.config.data_dir, onion).await;
         let peer_path = format!("/content/{}", content_id);
         // Generous overall timeout: this endpoint serves both seek/Range