feat: zero-config first boot and pluggable storage backend

Two changes that drop the friction in self-hosting RefBoard so the install
story becomes "docker compose up, open the URL".

1. JWT_SECRET is now optional. On first boot the backend generates a
   64-byte random secret and persists it in the existing settings table.
   process.env.JWT_SECRET still wins when set, so ops setups that manage
   secrets out-of-band are unaffected. The prod-throws-without-env guard
   is gone (auto-generation is a strictly safer default than the previous
   hardcoded dev fallback).

2. STORAGE_BACKEND=fs|minio picks between MinIO (default, unchanged) and
   a new local-filesystem adapter. The FS adapter exposes a fake minioClient
   that mirrors the methods RefBoard calls (statObject, getObject,
   getPartialObject, listObjectsV2, putObject, removeObject(s), bucketExists,
   makeBucket), so consumers swap require('./minio') for require('./storage')
   and nothing else changes. Sidecar .mime files hold Content-Type so the
   range-aware media proxy still serves the right response headers.

examples/compose/minimal-fs.yml is the single-container variant that uses
the FS adapter. The default docker-compose.yml still spins up MinIO.

README quick-start collapses to one block (cp .env, docker compose pull,
docker compose up -d). The first user you register on the Login screen is
auto-promoted to admin, same as before.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/db.js

@@ -327,6 +327,25 @@ function getBoolSetting(key, defaultValue = false) {
   }
 })();
 
+// JWT secret resolution.
+//   1. process.env.JWT_SECRET wins if set (lets ops manage secrets via env).
+//   2. Otherwise read from settings.jwt_secret.
+//   3. If neither exists, generate a 64-byte random secret and persist it.
+//
+// This removes the need to set JWT_SECRET in .env before first boot. The
+// first boot of a fresh install lands directly on the Login page in "create
+// the first admin" mode; tokens minted there are signed with the auto-
+// generated secret.
+function getOrCreateJwtSecret() {
+  if (process.env.JWT_SECRET) return process.env.JWT_SECRET;
+  const existing = getSetting('jwt_secret');
+  if (existing) return existing;
+  const generated = require('crypto').randomBytes(64).toString('base64');
+  setSetting('jwt_secret', generated);
+  console.log('[db] JWT_SECRET was not set in the environment — generated a fresh one and persisted it in the settings table.');
+  return generated;
+}
+
 // ---------------------
 // User helpers
 // ---------------------
@@ -823,6 +842,7 @@ module.exports = {
   getCommentsByThread, getCommentsByBoard, getComment, createComment, updateComment, deleteComment,
   // Settings
   getSetting, setSetting, getAllSettings, getBoolSetting,
+  getOrCreateJwtSecret,
   // Activity log
   logActivity, getBoardActivity,
   // Bootstrap