fix(backend): serve PDF/Markdown manuals inline so the viewer can render them

[gantoine]

Description
^{Explain the changes or enhancements you are proposing with this pull request.}

Uploaded manuals (a RomFile with category="manual") are served from GET /api/roms/{id}/files/content/{file_name}. That endpoint only treated soundtracks and image/video files as inline media, so manuals fell through to application/octet-stream + Content-Disposition: attachment. The same URL is used for both viewing and downloading, so downloads and the nav chrome kept working while the in-page PDF/Markdown viewer got an octet-stream/attachment response and rendered a blank area.

This only affected manuals uploaded as extra files. Scraped/primary manuals (rom.has_manual + rom.path_manual) load from the static-asset path and were unaffected, which is why the bug reproduced for some libraries but not others.

Changes:

• Add .pdf and .md to is_allowed_media_file (via a new ALLOWED_DOCUMENT_EXTENSIONS / is_allowed_document_file), with explicit MIME overrides (application/pdf, text/markdown) so the content type is trustworthy across platforms. Manuals are now served inline.
• Set X-Content-Type-Options: nosniff on inline responses (both the dev FileResponse and the nginx FileRedirectResponse). SVG is deliberately kept out of the inline allowlist because it can carry script, so serving Markdown inline warrants the same care: nosniff prevents the browser from sniffing a .md manual into HTML.
• Add endpoint tests covering the previously-untested manual content path.

Fixes #3712

AI assistance disclosure
^{Per CONTRIBUTING.md.}

This change was written with AI assistance (PostHog Code / Claude): investigation, code changes, and tests were AI-generated and human-reviewed.

Checklist
^{Please check all that apply.}

• I've tested the changes locally
• I've updated relevant comments
• I've assigned reviewers for this PR
• I've added unit tests that cover the changes

Screenshots (if applicable)

---

Created with PostHog Code

[Copilot]

Pull request overview

This PR fixes rendering of uploaded ROM manuals in the in-page manual viewer by serving PDF/Markdown files inline (with trusted MIME types) from the existing ROM file content endpoint, rather than forcing them to download as attachments.

Changes:

• Extend the inline-media allowlist to include .pdf and .md, with explicit MIME overrides (application/pdf, text/markdown).
• Add X-Content-Type-Options: nosniff for inline responses (both dev FileResponse and nginx X-Accel-Redirect responses).
• Add endpoint tests asserting inline disposition, correct Content-Type, and nosniff for PDF/Markdown manuals.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
backend/utils/media_types.py	Adds document extensions and MIME overrides so PDFs/Markdown can be served inline with consistent Content-Type.
backend/endpoints/roms/files.py	Applies nosniff to inline responses and forwards headers through both FileResponse and FileRedirectResponse.
backend/tests/endpoints/roms/test_files.py	Adds regression tests for serving PDF/Markdown manual files inline with expected headers.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[greptile-apps]

Greptile Summary

This PR lets uploaded manuals render inline from the ROM file content endpoint. The main changes are:

• Added PDF and Markdown to inline document handling.
• Added explicit MIME overrides for .pdf and .md.
• Added X-Content-Type-Options: nosniff to inline responses.
• Added endpoint tests for uploaded PDF and Markdown manuals.

Confidence Score: 5/5

The changed flow looks mergeable after a small cleanup to the document inline scope.

• PDF and Markdown manuals now get the headers the viewer needs.
• The response header wiring is compatible with both serving paths.
• Non-manual .pdf and .md files can now be served inline because the generic media helper changed.

backend/utils/media_types.py

Important Files Changed

Filename	Overview
backend/utils/media_types.py	Adds document extensions and MIME overrides to the generic inline media helper.
backend/endpoints/roms/files.py	Adds nosniff headers to inline file responses on both direct and nginx redirect paths.
backend/tests/endpoints/roms/test_files.py	Adds tests for uploaded PDF and Markdown manual content responses.

_{Reviews (1): Last reviewed commit: "fix(backend): serve PDF/Markdown manuals..." | Re-trigger Greptile}

Dismissed because a newer commit was pushed; Greptile will re-review the current head.