feat: zero-config first boot and pluggable storage backend

Two changes that drop the friction in self-hosting RefBoard so the install
story becomes "docker compose up, open the URL".

1. JWT_SECRET is now optional. On first boot the backend generates a
   64-byte random secret and persists it in the existing settings table.
   process.env.JWT_SECRET still wins when set, so ops setups that manage
   secrets out-of-band are unaffected. The prod-throws-without-env guard
   is gone (auto-generation is a strictly safer default than the previous
   hardcoded dev fallback).

2. STORAGE_BACKEND=fs|minio picks between MinIO (default, unchanged) and
   a new local-filesystem adapter. The FS adapter exposes a fake minioClient
   that mirrors the methods RefBoard calls (statObject, getObject,
   getPartialObject, listObjectsV2, putObject, removeObject(s), bucketExists,
   makeBucket), so consumers swap require('./minio') for require('./storage')
   and nothing else changes. Sidecar .mime files hold Content-Type so the
   range-aware media proxy still serves the right response headers.

examples/compose/minimal-fs.yml is the single-container variant that uses
the FS adapter. The default docker-compose.yml still spins up MinIO.

README quick-start collapses to one block (cp .env, docker compose pull,
docker compose up -d). The first user you register on the Login screen is
auto-promoted to admin, same as before.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/server.js

@@ -23,7 +23,7 @@ app.get('/api/images/*', async (req, res) => {
   try {
     const objectPath = req.params[0]; // everything after /api/images/
     if (!objectPath) return res.status(400).json({ error: 'Missing path' });
-    const { minioClient, MINIO_BUCKET } = require('./minio');
+    const { minioClient, MINIO_BUCKET } = require('./storage');
     const stat = await minioClient.statObject(MINIO_BUCKET, objectPath);
     const contentType = stat.metaData?.['content-type'] || 'application/octet-stream';
     const totalSize = stat.size;
@@ -162,6 +162,10 @@ async function start() {
   const dbModule = require('./db');
   console.log('[server] Database initialized');
 
+  // Resolve/generate the JWT secret eagerly so the "generated a fresh one"
+  // log line surfaces at boot, not on the first auth request.
+  dbModule.getOrCreateJwtSecret();
+
   try {
     await dbModule.seedAdminFromEnv();
   } catch (err) {
@@ -169,12 +173,12 @@ async function start() {
   }
 
   try {
-    const { initBucket } = require('./minio');
+    const { initBucket } = require('./storage');
     await initBucket();
-    console.log('[server] MinIO initialized');
+    console.log('[server] Storage backend initialized');
   } catch (err) {
-    console.error('[server] MinIO initialization failed:', err.message);
-    console.error('[server] Image uploads will not work until MinIO is available');
+    console.error('[server] Storage initialization failed:', err.message);
+    console.error('[server] Image uploads will not work until storage is available');
   }
 
   // Start media processing worker