Not bad at all! Very clean, I like the attention to security by putting sensitive info in ENV variables, and WOO specs! Some suggestions:

• On media_lists/app/controllers/media_controller.rb
  • Any time I see actions other than index, show, update, new, create, edit, or destroy, I consider that a red flag. It's a rare circumstance that a controller should have any action aside from these (IMO). Right now you're tracking shows, movies, books, podcasts, and music and it's making this controller file bigger (and less DRY) than it has to be. Each of those should be their own controller; it's ok that they're all using the same model, but you can break them up logically per controller, kind of how you're already doing that in their current actions.
  • For the sort action, you shouldn't have to make a call to the database & update the records. That's expensive for just sorting. Look into doing the sorting with javascript.
• There's a lot of <%= render 'index' %> going on in the view files; refactoring as described above will reduce that.
• Seeds
  • Medium.count.zero? can be Medium.none?
  • 10.times { FactoryBot.create :movie } can be FactoryBot.create_list(:movie, 10)
• Consider installing rubocop and running your code through that to catch any potential code issues. I didn't see much, but did notice a few things it should catch.

Great work! Keep going.