feat(render): node-agent AE snapshot runner (Epic C2) + colour render-binding (Epic B)

C2 — real-AE scene snapshots on the node:
- node-agent: runner/snapshot.go RunSnapshot (aerender -comp <key> -s f -e f
  → findRenderedOutput → ffmpeg -frames:v 1 PNG); client ClaimSnapshot /
  GetSnapshotUploadURL / ReportSnapshotResult / ReportSnapshotFail; snapshotLoop +
  pollSnapshotOnce mirroring the scan loop (reuses the AE-exclusive lock).
- render-svc: GetSnapshotJobMeta + UploadURL handler presigns a PUT to the
  public-read user-uploads bucket at snapshots/{project}/{scene}.png and returns a
  permanent public_url (not the time-limited export presign); MINIO_UPLOAD_BUCKET +
  MINIO_PUBLIC_URL config + compose env + /snapshot/:id/upload-url route.

Epic B — bind edited colours into the render:
- render-svc GetRenderBindings UNIONs studio.saved_shared_colors +
  saved_scene_colors (type 'color') so the node writes them before render.
- node-agent binder.go routes type:"color" bindings into the bind-spec colors[]
  array that bind.jsx already applies to the frshare colour layers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.v2.yml

@@ -193,6 +193,11 @@ services:
       MINIO_SECRET_KEY: "${MINIO_SECRET_KEY:-minioadmin}"
       MINIO_USE_SSL: "false"
       MINIO_BUCKET: "${MINIO_BUCKET:-flatrender-exports}"
+      # Scene snapshots upload to this public-read bucket; PUBLIC_URL is the
+      # browser-reachable base for the stored snapshot_url (defaults to the host
+      # MinIO endpoint above when unset).
+      MINIO_UPLOAD_BUCKET: "${MINIO_UPLOAD_BUCKET:-user-uploads}"
+      MINIO_PUBLIC_URL: "${NEXT_PUBLIC_MINIO_URL:-http://172.28.144.1:9000}"
       NOTIFICATION_URL: "http://notification-svc:8080"
       IDENTITY_URL: "http://identity-svc:8080"
       SERVICE_TOKEN: "${SERVICE_TOKEN:-internal-service-secret}"