feat(03-02): extend StorageBackend ABC and MinIOBackend with presigned PUT and stat_object

- Add generate_presigned_put_url and stat_object abstract methods to StorageBackend ABC
- Extend MinIOBackend with dual client (self._client internal + self._public_client public)
- MinIOBackend.__init__ accepts optional public_endpoint param (RESEARCH.md Finding 3)
- generate_presigned_put_url uses self._public_client for browser-resolvable URLs
- stat_object uses self._client.stat_object and returns .size (authoritative, T-03-05)
- get_storage_backend() passes public_endpoint=settings.minio_public_endpoint
- config.py adds minio_public_endpoint field (RESEARCH.md Finding 3)
- docker-compose.yml: MINIO_API_CORS_ALLOW_ORIGIN on minio service (T-03-09)
- docker-compose.yml: MINIO_PUBLIC_ENDPOINT on backend service
- docker-compose.yml: new celery-beat service (RESEARCH.md Finding 10)

backend/config.py

@@ -25,6 +25,9 @@ class Settings(BaseSettings):
     minio_access_key: str = "docuvault_app"
     minio_secret_key: str = "changeme_minio_app"
     minio_bucket: str = "docuvault"
+    # RESEARCH.md Finding 3 — browser-resolvable hostname for presigned URLs.
+    # Empty string means fall back to minio_endpoint inside MinIOBackend.
+    minio_public_endpoint: str = ""
 
     # Redis / Celery
     redis_url: str = "redis://:changeme_redis@redis:6379/0"