feat(m8): P1 MinIO 对象存储与文件管理

- 迁移 000023 gateway.file_objects(personal/system 归属隔离 + 部分索引)
- internal/platform/storage:minio-go 适配(端点 scheme 剥离、流式 PutObject/Open/Delete)
- internal/workbench/files.go:FileService(sha256 校验、PutObject-then-insert 回滚、delete 先删行再删对象)
- admin /api/v1/admin/files + portal /api/v1/portal/files 处理器(流式上传下载、Content-Disposition)
- RBAC file:read/file:manage;菜单加文件管理 + 门户文件仓库
- compose 增 minio 服务(S3_* anchor、不暴露端口);nginx client_max_body_size 32m→256m
- 管理端文件管理页 + 门户个人文件仓;集成测试 TestFileObjectLifecycle 连真 MinIO 通过
- healthz object_storage:true;README/PRODUCTION/进展文档同步

Co-Authored-By: Claude <noreply@anthropic.com>

deploy/docker-compose.production.yml

@@ -26,6 +26,13 @@ x-gateway-environment: &gateway-environment
   SHADOW_BASE_URL: ${SHADOW_BASE_URL:-}
   SHADOW_API_KEY: ${SHADOW_API_KEY:-}
   SHADOW_SAMPLE_RATE: ${SHADOW_SAMPLE_RATE:-0}
+  S3_ENDPOINT: ${S3_ENDPOINT:-http://minio:9000}
+  S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-gateway}
+  S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-}
+  S3_BUCKET: ${S3_BUCKET:-gateway-files}
+  S3_REGION: ${S3_REGION:-us-east-1}
+  S3_USE_SSL: ${S3_USE_SSL:-false}
+  S3_MAX_FILE_BYTES: ${S3_MAX_FILE_BYTES:-134217728}
 
 x-backend-service: &backend-service
   image: ai-gateway-go:${GATEWAY_VERSION:-0.10.0}
@@ -107,6 +114,8 @@ services:
         condition: service_healthy
       redis-cache:
         condition: service_healthy
+      minio:
+        condition: service_started
     healthcheck:
       test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:8080/readyz"]
       interval: 10s
@@ -171,6 +180,18 @@ services:
         condition: service_healthy
     restart: unless-stopped
 
+  # M8: 对象存储。MinIO 不暴露主机端口,上传/下载全部经网关代理;
+  # 桶由 gateway-api 启动时的 EnsureBucket 兜底创建。stateful 服务不做加固。
+  minio:
+    image: minio/minio:latest
+    command: ["server", "/data", "--console-address", ":9001"]
+    environment:
+      MINIO_ROOT_USER: ${S3_ACCESS_KEY_ID:-gateway}
+      MINIO_ROOT_PASSWORD: ${S3_SECRET_ACCESS_KEY:-}
+    volumes:
+      - minio-data:/data
+    restart: unless-stopped
+
   bootstrap-admin:
     <<: *backend-service
     profiles: ["tools"]
@@ -187,3 +208,4 @@ services:
 volumes:
   postgres-data:
   redis-critical-data:
+  minio-data: