feat(m8): P1 MinIO 对象存储与文件管理

- 迁移 000023 gateway.file_objects(personal/system 归属隔离 + 部分索引)
- internal/platform/storage:minio-go 适配(端点 scheme 剥离、流式 PutObject/Open/Delete)
- internal/workbench/files.go:FileService(sha256 校验、PutObject-then-insert 回滚、delete 先删行再删对象)
- admin /api/v1/admin/files + portal /api/v1/portal/files 处理器(流式上传下载、Content-Disposition)
- RBAC file:read/file:manage;菜单加文件管理 + 门户文件仓库
- compose 增 minio 服务(S3_* anchor、不暴露端口);nginx client_max_body_size 32m→256m
- 管理端文件管理页 + 门户个人文件仓;集成测试 TestFileObjectLifecycle 连真 MinIO 通过
- healthz object_storage:true;README/PRODUCTION/进展文档同步

Co-Authored-By: Claude <noreply@anthropic.com>

deploy/PRODUCTION.md

@@ -1,8 +1,9 @@
 # Production deployment
 
 This bundle builds the Go services and both Art Design Pro applications from
-source. PostgreSQL and two Redis roles are included; MinIO/S3 and ClickHouse are
-not required.
+source. PostgreSQL, two Redis roles and MinIO (object storage, M8) are included;
+ClickHouse is not required. MinIO is not a startup dependency: the gateway only
+warns and refuses file uploads until the bucket is reachable.
 
 ## Prerequisites
 

deploy/docker-compose.production.yml

@@ -26,6 +26,13 @@ x-gateway-environment: &gateway-environment
   SHADOW_BASE_URL: ${SHADOW_BASE_URL:-}
   SHADOW_API_KEY: ${SHADOW_API_KEY:-}
   SHADOW_SAMPLE_RATE: ${SHADOW_SAMPLE_RATE:-0}
+  S3_ENDPOINT: ${S3_ENDPOINT:-http://minio:9000}
+  S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-gateway}
+  S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-}
+  S3_BUCKET: ${S3_BUCKET:-gateway-files}
+  S3_REGION: ${S3_REGION:-us-east-1}
+  S3_USE_SSL: ${S3_USE_SSL:-false}
+  S3_MAX_FILE_BYTES: ${S3_MAX_FILE_BYTES:-134217728}
 
 x-backend-service: &backend-service
   image: ai-gateway-go:${GATEWAY_VERSION:-0.10.0}
@@ -107,6 +114,8 @@ services:
         condition: service_healthy
       redis-cache:
         condition: service_healthy
+      minio:
+        condition: service_started
     healthcheck:
       test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:8080/readyz"]
       interval: 10s
@@ -171,6 +180,18 @@ services:
         condition: service_healthy
     restart: unless-stopped
 
+  # M8: 对象存储。MinIO 不暴露主机端口,上传/下载全部经网关代理;
+  # 桶由 gateway-api 启动时的 EnsureBucket 兜底创建。stateful 服务不做加固。
+  minio:
+    image: minio/minio:latest
+    command: ["server", "/data", "--console-address", ":9001"]
+    environment:
+      MINIO_ROOT_USER: ${S3_ACCESS_KEY_ID:-gateway}
+      MINIO_ROOT_PASSWORD: ${S3_SECRET_ACCESS_KEY:-}
+    volumes:
+      - minio-data:/data
+    restart: unless-stopped
+
   bootstrap-admin:
     <<: *backend-service
     profiles: ["tools"]
@@ -187,3 +208,4 @@ services:
 volumes:
   postgres-data:
   redis-critical-data:
+  minio-data:

deploy/docker-compose.yml

@@ -58,6 +58,13 @@ services:
       SHADOW_BASE_URL: ${SHADOW_BASE_URL:-}
       SHADOW_API_KEY: ${SHADOW_API_KEY:-}
       SHADOW_SAMPLE_RATE: ${SHADOW_SAMPLE_RATE:-0}
+      S3_ENDPOINT: ${S3_ENDPOINT:-http://minio:9000}
+      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-gateway}
+      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-gateway-secret}
+      S3_BUCKET: ${S3_BUCKET:-gateway-files}
+      S3_REGION: ${S3_REGION:-us-east-1}
+      S3_USE_SSL: ${S3_USE_SSL:-false}
+      S3_MAX_FILE_BYTES: ${S3_MAX_FILE_BYTES:-134217728}
     depends_on:
       postgres:
         condition: service_healthy
@@ -78,6 +85,20 @@ services:
         condition: service_healthy
       redis-cache:
         condition: service_healthy
+      minio:
+        condition: service_started
+    restart: unless-stopped
+
+  # M8: 对象存储。MinIO 不暴露主机端口,凭据只留在 API 容器内;
+  # 上传/下载全部经网关代理。桶由 gateway-api 启动时的 EnsureBucket 兜底创建。
+  minio:
+    image: minio/minio:latest
+    command: ["server", "/data", "--console-address", ":9001"]
+    environment:
+      MINIO_ROOT_USER: ${S3_ACCESS_KEY_ID:-gateway}
+      MINIO_ROOT_PASSWORD: ${S3_SECRET_ACCESS_KEY:-gateway-secret}
+    volumes:
+      - minio-data:/data
     restart: unless-stopped
 
   admin-web:
@@ -152,3 +173,4 @@ services:
 volumes:
   postgres-data:
   redis-critical-data:
+  minio-data:

deploy/nginx-web.conf

@@ -8,10 +8,10 @@ server {
     # and an absolute redirect would drop that port and send browsers to :80.
     absolute_redirect off;
 
-    # Match the gateway's HTTP_MAX_BODY_BYTES (default 32 MiB). nginx's default
-    # of 1 MiB otherwise rejects large prompts and knowledge-base imports with
-    # 413 before they ever reach the gateway.
-    client_max_body_size 32m;
+    # 256 MiB 必须盖过文件上传上限 S3_MAX_FILE_BYTES（默认 128 MiB）。文件体
+    # 由网关的流式上传处理器把关（http.MaxBytesReader + LimitReader），
+    # nginx 只做最外层限制，避免大文件在到达网关前就被 413 拒绝。
+    client_max_body_size 256m;
 
     root /usr/share/nginx/html;
     index index.html;

deploy/production.env.example

@@ -37,6 +37,17 @@ ADMIN_PORT=8081
 PORTAL_PORT=8082
 REDIS_CACHE_MAXMEMORY=256mb
 
+# M8 对象存储（MinIO）。MinIO 不暴露主机端口，上传/下载全部经网关代理。
+# 生产建议生成强随机密钥对（S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEY），
+# compose 的 minio 服务会用这两个值初始化 MINIO_ROOT_USER/PASSWORD。
+S3_ENDPOINT=http://minio:9000
+S3_ACCESS_KEY_ID=CHANGE_ME_MINIO_ACCESS_KEY
+S3_SECRET_ACCESS_KEY=CHANGE_ME_MINIO_SECRET_KEY
+S3_BUCKET=gateway-files
+S3_REGION=us-east-1
+S3_USE_SSL=false
+S3_MAX_FILE_BYTES=134217728
+
 # Used only for the one-time bootstrap-admin command; remove after use.
 BOOTSTRAP_ADMIN_USERNAME=admin
 BOOTSTRAP_ADMIN_PASSWORD=CHANGE_ME_AT_LEAST_12_CHARACTERS