feat(m8): P1 MinIO 对象存储与文件管理

- 迁移 000023 gateway.file_objects(personal/system 归属隔离 + 部分索引)
- internal/platform/storage:minio-go 适配(端点 scheme 剥离、流式 PutObject/Open/Delete)
- internal/workbench/files.go:FileService(sha256 校验、PutObject-then-insert 回滚、delete 先删行再删对象)
- admin /api/v1/admin/files + portal /api/v1/portal/files 处理器(流式上传下载、Content-Disposition)
- RBAC file:read/file:manage;菜单加文件管理 + 门户文件仓库
- compose 增 minio 服务(S3_* anchor、不暴露端口);nginx client_max_body_size 32m→256m
- 管理端文件管理页 + 门户个人文件仓;集成测试 TestFileObjectLifecycle 连真 MinIO 通过
- healthz object_storage:true;README/PRODUCTION/进展文档同步

Co-Authored-By: Claude <noreply@anthropic.com>

deploy/nginx-web.conf

@@ -8,10 +8,10 @@ server {
     # and an absolute redirect would drop that port and send browsers to :80.
     absolute_redirect off;
 
-    # Match the gateway's HTTP_MAX_BODY_BYTES (default 32 MiB). nginx's default
-    # of 1 MiB otherwise rejects large prompts and knowledge-base imports with
-    # 413 before they ever reach the gateway.
-    client_max_body_size 32m;
+    # 256 MiB 必须盖过文件上传上限 S3_MAX_FILE_BYTES（默认 128 MiB）。文件体
+    # 由网关的流式上传处理器把关（http.MaxBytesReader + LimitReader），
+    # nginx 只做最外层限制，避免大文件在到达网关前就被 413 拒绝。
+    client_max_body_size 256m;
 
     root /usr/share/nginx/html;
     index index.html;