feat(m8): P1 MinIO 对象存储与文件管理

- 迁移 000023 gateway.file_objects(personal/system 归属隔离 + 部分索引)
- internal/platform/storage:minio-go 适配(端点 scheme 剥离、流式 PutObject/Open/Delete)
- internal/workbench/files.go:FileService(sha256 校验、PutObject-then-insert 回滚、delete 先删行再删对象)
- admin /api/v1/admin/files + portal /api/v1/portal/files 处理器(流式上传下载、Content-Disposition)
- RBAC file:read/file:manage;菜单加文件管理 + 门户文件仓库
- compose 增 minio 服务(S3_* anchor、不暴露端口);nginx client_max_body_size 32m→256m
- 管理端文件管理页 + 门户个人文件仓;集成测试 TestFileObjectLifecycle 连真 MinIO 通过
- healthz object_storage:true;README/PRODUCTION/进展文档同步

Co-Authored-By: Claude <noreply@anthropic.com>

cmd/gateway-api/main.go

@@ -23,6 +23,7 @@ import (
 	"aigateway.local/core/internal/platform/cryptox"
 	"aigateway.local/core/internal/platform/database"
 	"aigateway.local/core/internal/platform/health"
+	"aigateway.local/core/internal/platform/storage"
 	"aigateway.local/core/internal/platform/httpserver"
 	"aigateway.local/core/internal/portal"
 	"aigateway.local/core/internal/pricing"
@@ -231,6 +232,28 @@ func main() {
 	marketplaceService := workbench.NewMarketplaceService(workbenchService, mcpServerService, skillService, digitalEmployeeService)
 	mcpClient := workbench.NewMCPClient(cfg.Credentials.AllowPrivateToolURL, 60*time.Second)
 	marketplaceHandler := workbench.NewMarketplaceAdminHTTPHandler(marketplaceService, mcpServerService, skillService, digitalEmployeeService, mcpClient, identityService)
+	// M8: 对象存储(MinIO)文件管理。文件体在 MinIO,元数据在 PostgreSQL。MinIO
+	// 不暴露主机端口,上传/下载全部经网关代理,凭据只留在 API 容器内。
+	objectStore, err := storage.NewClient(storage.Config{
+		Endpoint:        cfg.ObjectStorage.Endpoint,
+		AccessKeyID:     cfg.ObjectStorage.AccessKeyID,
+		SecretAccessKey: cfg.ObjectStorage.SecretAccessKey,
+		Bucket:          cfg.ObjectStorage.Bucket,
+		Region:          cfg.ObjectStorage.Region,
+		UseSSL:          cfg.ObjectStorage.UseSSL,
+		MaxFileBytes:    cfg.ObjectStorage.MaxFileBytes,
+	})
+	if err != nil {
+		logger.Error("object storage client initialization failed", "error", err)
+		os.Exit(1)
+	}
+	if err := objectStore.EnsureBucket(ctx); err != nil {
+		// 桶未就绪不致命:MinIO 起来后会自动建桶,当前上传请求会得到明确报错。
+		logger.Warn("object storage bucket is not ready; uploads fail until MinIO is reachable", "error", err)
+	}
+	fileService := workbench.NewFileService(workbenchService, objectStore)
+	filesAdminHandler := workbench.NewFilesAdminHTTPHandler(fileService, identityService)
+	filesPortalHandler := workbench.NewFilesPortalHTTPHandler(fileService, identityService)
 	applicationKeyCipher, err := cryptox.NewKeyring(
 		cfg.Credentials.MasterKey, cfg.Credentials.KEKVersion, cfg.Credentials.KEKKeyring, "application-runtime-key",
 	)
@@ -307,6 +330,10 @@ func main() {
 	controlMux.Handle("/api/v1/admin/model-requests/", portalAdminHandler)
 	controlMux.Handle("/api/v1/admin/system-info", operationsHandler)
 	controlMux.Handle("/api/v1/admin/monitoring/overview", operationsHandler)
+	controlMux.Handle("/api/v1/admin/files", filesAdminHandler)
+	controlMux.Handle("/api/v1/admin/files/", filesAdminHandler)
+	controlMux.Handle("/api/v1/portal/files", filesPortalHandler)
+	controlMux.Handle("/api/v1/portal/files/", filesPortalHandler)
 	controlMux.Handle("/api/v1/admin/reload", operationsHandler)
 	controlMux.Handle("/api/v1/admin/identities/", identityManagementHandler)
 	controlMux.Handle("/api/v1/admin/departments", identityManagementHandler)