[T4-4] Where uploaded files live in v1

[liangricky7]

Blocked by: — · Blocks: T4-5 (#24)

Production stores media in private S3. v1 runs on each laptop, so it needs a local stand-in.

• Recommendation: MinIO, an S3-compatible server, as a second container in backend/database/docker-compose.yml. The upload and signed-link code is then identical to production's, with no second version to write and later throw away
• Bound to 127.0.0.1 only, like the database. Its bucket is private
• npm run db:up starts both. The database README gains a short section on it
• Record the decision alongside D-2 ([D-2] Decide the v1 deployment posture #31) (v1 deployment posture), since they affect each other

---

Source: docs/backend-tickets.md