feat(admin): media library + upload component (replace URL fields)

- /admin/files Media Library: drag-drop multi-upload, thumbnails, copy-URL, delete
- FileUploadField replaces raw URL inputs; new "image" field type in AdminResource;
  wired into category image
- upload proxy /api/admin/files/upload: browser → Next → presigned PUT (server-side,
  reaches minio:9000) → confirm → returns public URL
- user-uploads bucket is public-read; public base via NEXT_PUBLIC_MINIO_URL

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -33,6 +33,8 @@ ARG NEXT_PUBLIC_SITE_URL=http://localhost:3000
 # V2: browser-facing gateway base (host-exposed port) + tenant for Identity auth
 ARG NEXT_PUBLIC_API_URL=http://localhost:8088/v1
 ARG NEXT_PUBLIC_TENANT_SLUG=flatrender
+# Browser-reachable MinIO base for public (user-uploads) object URLs.
+ARG NEXT_PUBLIC_MINIO_URL=http://localhost:9000
 
 ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL
 ENV NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY
@@ -40,6 +42,7 @@ ENV NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=$NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY
 ENV NEXT_PUBLIC_SITE_URL=$NEXT_PUBLIC_SITE_URL
 ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL
 ENV NEXT_PUBLIC_TENANT_SLUG=$NEXT_PUBLIC_TENANT_SLUG
+ENV NEXT_PUBLIC_MINIO_URL=$NEXT_PUBLIC_MINIO_URL
 
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV NODE_ENV=production