feat: zero-config first boot and pluggable storage backend

Two changes that drop the friction in self-hosting RefBoard so the install
story becomes "docker compose up, open the URL".

1. JWT_SECRET is now optional. On first boot the backend generates a
   64-byte random secret and persists it in the existing settings table.
   process.env.JWT_SECRET still wins when set, so ops setups that manage
   secrets out-of-band are unaffected. The prod-throws-without-env guard
   is gone (auto-generation is a strictly safer default than the previous
   hardcoded dev fallback).

2. STORAGE_BACKEND=fs|minio picks between MinIO (default, unchanged) and
   a new local-filesystem adapter. The FS adapter exposes a fake minioClient
   that mirrors the methods RefBoard calls (statObject, getObject,
   getPartialObject, listObjectsV2, putObject, removeObject(s), bucketExists,
   makeBucket), so consumers swap require('./minio') for require('./storage')
   and nothing else changes. Sidecar .mime files hold Content-Type so the
   range-aware media proxy still serves the right response headers.

examples/compose/minimal-fs.yml is the single-container variant that uses
the FS adapter. The default docker-compose.yml still spins up MinIO.

README quick-start collapses to one block (cp .env, docker compose pull,
docker compose up -d). The first user you register on the Login screen is
auto-promoted to admin, same as before.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/auth.js

@@ -1,27 +1,31 @@
 const jwt = require('jsonwebtoken');
 const bcrypt = require('bcryptjs');
 
-const JWT_SECRET = process.env.JWT_SECRET || (() => {
-  if (process.env.NODE_ENV === 'production') {
-    throw new Error('JWT_SECRET environment variable is required in production');
-  }
-  return 'refboard-dev-secret-do-not-use-in-prod';
-})();
-
 const JWT_EXPIRES_IN = process.env.JWT_EXPIRES_IN || '7d';
 const BCRYPT_ROUNDS = 12;
 const REFBOARD_API_KEY = process.env.REFBOARD_API_KEY || '';
 
+// Memoized — resolved lazily so db.js is required after its module
+// initialization side-effects have run. After the first call the secret is
+// cached for the life of the process.
+let _cachedJwtSecret = null;
+function jwtSecret() {
+  if (_cachedJwtSecret) return _cachedJwtSecret;
+  const { getOrCreateJwtSecret } = require('./db');
+  _cachedJwtSecret = getOrCreateJwtSecret();
+  return _cachedJwtSecret;
+}
+
 function generateToken(user) {
   return jwt.sign(
     { id: user.id, email: user.email, role: user.role, username: user.username, display_name: user.display_name },
-    JWT_SECRET,
+    jwtSecret(),
     { expiresIn: JWT_EXPIRES_IN }
   );
 }
 
 function verifyToken(token) {
-  return jwt.verify(token, JWT_SECRET);
+  return jwt.verify(token, jwtSecret());
 }
 
 async function hashPassword(password) {
@@ -122,5 +126,4 @@ module.exports = {
   adminMiddleware,
   apiKeyMiddleware,
   adminOrApiKeyMiddleware,
-  JWT_SECRET,
 };