feat: zero-config first boot and pluggable storage backend

Two changes that drop the friction in self-hosting RefBoard so the install
story becomes "docker compose up, open the URL".

1. JWT_SECRET is now optional. On first boot the backend generates a
   64-byte random secret and persists it in the existing settings table.
   process.env.JWT_SECRET still wins when set, so ops setups that manage
   secrets out-of-band are unaffected. The prod-throws-without-env guard
   is gone (auto-generation is a strictly safer default than the previous
   hardcoded dev fallback).

2. STORAGE_BACKEND=fs|minio picks between MinIO (default, unchanged) and
   a new local-filesystem adapter. The FS adapter exposes a fake minioClient
   that mirrors the methods RefBoard calls (statObject, getObject,
   getPartialObject, listObjectsV2, putObject, removeObject(s), bucketExists,
   makeBucket), so consumers swap require('./minio') for require('./storage')
   and nothing else changes. Sidecar .mime files hold Content-Type so the
   range-aware media proxy still serves the right response headers.

examples/compose/minimal-fs.yml is the single-container variant that uses
the FS adapter. The default docker-compose.yml still spins up MinIO.

README quick-start collapses to one block (cp .env, docker compose pull,
docker compose up -d). The first user you register on the Login screen is
auto-promoted to admin, same as before.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -8,9 +8,19 @@ PORT=8000
 NODE_ENV=development
 CORS_ORIGIN=*
 
+# ---- Container image (Docker Compose only) ----
+# Pre-built multi-arch images are published to GHCR on every push to main.
+# Pin a release with e.g. ghcr.io/metalfinger/refboard:v0.5.0 — see
+# https://github.com/metalfinger/refboard/pkgs/container/refboard for tags.
+REFBOARD_IMAGE=ghcr.io/metalfinger/refboard:latest
+
 # ---- JWT auth ----
-# REQUIRED in production. Generate with: openssl rand -base64 64
-JWT_SECRET=change-me-to-a-long-random-string
+# OPTIONAL. If unset, RefBoard generates a 64-byte random secret on first boot
+# and persists it in the SQLite settings table. Set this env var only if you
+# want ops to manage the secret out-of-band (e.g. via a secrets manager) — when
+# set, it always overrides the persisted value. Rotate by clearing the env var
+# *and* deleting the settings.jwt_secret row; this invalidates existing tokens.
+# JWT_SECRET=
 JWT_EXPIRES_IN=7d
 
 # ---- SQLite database ----
@@ -18,7 +28,16 @@ JWT_EXPIRES_IN=7d
 # For local non-Docker dev, set this to ./data/refboard.db (relative to backend/).
 DB_PATH=/app/data/refboard.db
 
-# ---- Object storage (MinIO / any S3-compatible) ----
+# ---- Object storage ----
+# STORAGE_BACKEND=minio (default) — uses MinIO or any S3-compatible store.
+# STORAGE_BACKEND=fs            — stores media bytes on the local filesystem
+#                                  under STORAGE_DATA_DIR. Collapses the stack
+#                                  to a single container; see
+#                                  examples/compose/minimal-fs.yml.
+STORAGE_BACKEND=minio
+STORAGE_DATA_DIR=/app/data/storage
+
+# MinIO settings (ignored when STORAGE_BACKEND=fs)
 MINIO_ENDPOINT=minio
 MINIO_PORT=9000
 MINIO_USE_SSL=false