Fix manage handlers ignoring multipart form bodies

The /manage page posts with FormData, i.e. multipart/form-data, but the edit,
delete, tags, restore and empty-trash handlers parsed with r.ParseForm, which
only reads urlencoded bodies. So every field came back empty: delete returned
200 with deleted:0 and moved nothing, edits saved nothing — while curl -d
(urlencoded) worked, which is why tests and manual checks missed it.

Parse with ParseMultipartForm (tolerating ErrNotMultipart so urlencoded still
works), via a shared parseForm helper used by all manage handlers. handleUpload
already did this. Also stop the UI reporting deleted:0 / updated:0 as success,
and add a multipart regression test.

manage.go

@@ -69,7 +69,7 @@ func (s *Server) handleEdit(w http.ResponseWriter, r *http.Request) {
 	if s.rejectCrossSite(w, r) {
 		return
 	}
-	if err := r.ParseForm(); err != nil {
+	if err := parseForm(r); err != nil {
 		http.Error(w, "bad request", http.StatusBadRequest)
 		return
 	}
@@ -191,6 +191,19 @@ func (s *Server) handleBulkTags(w http.ResponseWriter, r *http.Request) {
 
 // ── helpers ────────────────────────────────────────────────────────────────
 
+// parseForm reads form values from either an application/x-www-form-urlencoded
+// or a multipart/form-data body. Browsers posting FormData send multipart,
+// which r.ParseForm alone does not read from the body; ParseMultipartForm
+// handles both — it runs ParseForm internally (so query and urlencoded values
+// are parsed) and only reports ErrNotMultipart for a non-multipart body, by
+// which point those values are already available.
+func parseForm(r *http.Request) error {
+	if err := r.ParseMultipartForm(32 << 20); err != nil && err != http.ErrNotMultipart {
+		return err
+	}
+	return nil
+}
+
 // resolveSlug reports whether slug names an existing post and returns the image
 // path. It rejects anything that is not a bare, safe filename, closing path
 // traversal and access to dotfiles such as the .trash directory.
@@ -210,7 +223,7 @@ func (s *Server) resolveSlug(slug string) (string, bool) {
 // formSlugs collects slugs from repeated `slug` fields and/or a comma-separated
 // `slugs` field, de-duplicated.
 func (s *Server) formSlugs(r *http.Request) ([]string, error) {
-	if err := r.ParseForm(); err != nil {
+	if err := parseForm(r); err != nil {
 		return nil, err
 	}
 	seen := make(map[string]bool)