feat(m8): P1 MinIO 对象存储与文件管理

- 迁移 000023 gateway.file_objects(personal/system 归属隔离 + 部分索引)
- internal/platform/storage:minio-go 适配(端点 scheme 剥离、流式 PutObject/Open/Delete)
- internal/workbench/files.go:FileService(sha256 校验、PutObject-then-insert 回滚、delete 先删行再删对象)
- admin /api/v1/admin/files + portal /api/v1/portal/files 处理器(流式上传下载、Content-Disposition)
- RBAC file:read/file:manage;菜单加文件管理 + 门户文件仓库
- compose 增 minio 服务(S3_* anchor、不暴露端口);nginx client_max_body_size 32m→256m
- 管理端文件管理页 + 门户个人文件仓;集成测试 TestFileObjectLifecycle 连真 MinIO 通过
- healthz object_storage:true;README/PRODUCTION/进展文档同步

Co-Authored-By: Claude <noreply@anthropic.com>

internal/workbench/portal_files_http.go

@@ -0,0 +1,133 @@
+package workbench
+
+import (
+	"errors"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"strings"
+
+	"aigateway.local/core/internal/identity"
+	"aigateway.local/core/internal/platform/apiresponse"
+)
+
+// FilesPortalHTTPHandler serves each portal user's personal file store. Unlike
+// the admin handler every object is scoped to the authenticated account, so a
+// user can only ever see and open their own files.
+type FilesPortalHTTPHandler struct {
+	files    *FileService
+	identity *identity.Service
+	mux      *http.ServeMux
+}
+
+func NewFilesPortalHTTPHandler(files *FileService, identityService *identity.Service) *FilesPortalHTTPHandler {
+	h := &FilesPortalHTTPHandler{files: files, identity: identityService, mux: http.NewServeMux()}
+	h.mux.HandleFunc("POST /api/v1/portal/files", h.upload)
+	h.mux.HandleFunc("GET /api/v1/portal/files", h.list)
+	h.mux.HandleFunc("GET /api/v1/portal/files/{id}/download", h.download)
+	h.mux.HandleFunc("DELETE /api/v1/portal/files/{id}", h.delete)
+	return h
+}
+
+func (h *FilesPortalHTTPHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { h.mux.ServeHTTP(w, r) }
+
+func (h *FilesPortalHTTPHandler) account(w http.ResponseWriter, r *http.Request) (identity.Account, bool) {
+	account, err := h.identity.Authenticate(r.Context(), identity.KindPortal, r.Header.Get("Authorization"))
+	if err != nil {
+		apiresponse.Error(w, http.StatusUnauthorized, "登录状态无效或已过期")
+		return identity.Account{}, false
+	}
+	return account, true
+}
+
+func (h *FilesPortalHTTPHandler) upload(w http.ResponseWriter, r *http.Request) {
+	a, ok := h.account(w, r)
+	if !ok {
+		return
+	}
+	var (
+		body          io.Reader
+		originalName  = strings.TrimSpace(r.URL.Query().Get("filename"))
+		contentType   = r.Header.Get("Content-Type")
+	)
+	if strings.HasPrefix(contentType, "multipart/form-data") {
+		part, err := h.firstFilePart(r)
+		if err != nil {
+			apiresponse.Error(w, http.StatusBadRequest, "缺少上传文件")
+			return
+		}
+		defer part.Close()
+		body = part
+		originalName = part.FileName()
+		if ct := part.Header.Get("Content-Type"); ct != "" {
+			contentType = ct
+		}
+	}
+	if originalName == "" {
+		apiresponse.Error(w, http.StatusBadRequest, "缺少文件名")
+		return
+	}
+	obj, err := h.files.Upload(r.Context(), "personal", &a.ID, a.ID, originalName, contentType, body)
+	if err != nil {
+		fileError(w, err)
+		return
+	}
+	apiresponse.OK(w, obj)
+}
+
+func (h *FilesPortalHTTPHandler) firstFilePart(r *http.Request) (*multipart.Part, error) {
+	reader, err := r.MultipartReader()
+	if err != nil {
+		return nil, err
+	}
+	for {
+		part, err := reader.NextPart()
+		if err == io.EOF {
+			return nil, errors.New("no file part")
+		}
+		if err != nil {
+			return nil, err
+		}
+		if part.FormName() == "file" {
+			return part, nil
+		}
+	}
+}
+
+func (h *FilesPortalHTTPHandler) list(w http.ResponseWriter, r *http.Request) {
+	a, ok := h.account(w, r)
+	if !ok {
+		return
+	}
+	items, err := h.files.ListPersonal(r.Context(), a.ID)
+	if err != nil {
+		fileError(w, err)
+		return
+	}
+	apiresponse.OK(w, items)
+}
+
+func (h *FilesPortalHTTPHandler) download(w http.ResponseWriter, r *http.Request) {
+	a, ok := h.account(w, r)
+	if !ok {
+		return
+	}
+	obj, err := h.files.GetPersonal(r.Context(), a.ID, r.PathValue("id"))
+	if err != nil {
+		fileError(w, err)
+		return
+	}
+	serveFileContent(w, r, h.files, obj)
+}
+
+func (h *FilesPortalHTTPHandler) delete(w http.ResponseWriter, r *http.Request) {
+	a, ok := h.account(w, r)
+	if !ok {
+		return
+	}
+	if err := h.files.DeletePersonal(r.Context(), a.ID, r.PathValue("id")); err != nil {
+		fileError(w, err)
+		return
+	}
+	apiresponse.OK(w, map[string]bool{"deleted": true})
+}