- make minio bucket downloadable for direct media links
- switch object keys to random uuid-based names
- add client-side image compression before upload
- add S3_PUBLIC_ENDPOINT_URL for browser-reachable presigned urls
- support both public/internal file url validation
- configure MinIO bucket CORS in minio-init
- update env examples and docs