Add media picker exclusion config to theme schema and media inputs

[hta218]

Follow-up to #519. Adds the developer-declared half of Media Manager filtering; the Studio side is Weaverse/builder#2877.

What

Two places a theme author can declare what the Media Manager gallery hides:

// store-wide default
export const themeSchema: HydrogenThemeSchema = {
  info: { ... },
  i18n: { ... },
  media: {
    excludeFilenamePrefixes: ['thumb_v'],
    excludeProductFiles: true,
  },
  settings: [ ... ],
}

// per-input override
{
  type: 'image',
  name: 'heroImage',
  configs: { excludeFilenamePrefixes: ['thumb_v'] },
}

Studio resolves them per field:

prefixes     = input.excludeFilenamePrefixes ?? theme.excludeFilenamePrefixes ?? []
productFiles = input.excludeProductFiles     ?? theme.excludeProductFiles     ?? false

An omitted key inherits, an array replaces, [] deliberately shows every file. No allowOverride flag — key presence is the signal.

Notes

media is a sibling of settings, not an entry inside it. settings is InspectorGroup[] and renders as merchant-editable controls in Studio; these rules are meant to be fixed by the theme author.

image / video configs are now validated. They previously fell through to default: return in BasicInputSchema, which allowed any structure. The source is now theme code with no Studio UI to recover from a mistake, so a mistyped exclusion (a bare string instead of an array) has to surface at authoring time rather than silently disabling filtering. z.object is non-strict, so themes carrying unrelated keys in an image/video configs still parse.

The theme-side type is inline rather than imported from @weaverse/schema. packages/hydrogen resolves the published @weaverse/schema@0.14.0 from the registry, not the workspace copy, so importing MediaInputConfigs here would fail pnpm run typecheck until schema ships. HydrogenThemeSchema already types info and i18n inline, so media matches. Worth switching to the shared type once schema is published.

excludeProductFiles matches usage, not origin — it maps to Shopify's used_in:product, so a file uploaded to Files and later attached to a product is hidden too. Studio's UI copy says "used in products" for that reason.

Verification

• pnpm run biome — clean
• pnpm run typecheck — 6/6 packages
• pnpm exec vp test --run packages/schema packages/hydrogen — 18 files, 269 tests passing (8 new)
• pnpm run api:report — reports regenerated and committed

Out of scope

Per-input allow-list (show only files matching a prefix). No use case raised, and excludeFilenamePrefixes: [] already covers "this picker shows everything".