feat(phase-4): Alembic migration 0004 (pdf_open_mode, GIN FTS index, audit-logs bucket) + MinIOBackend.put_object_raw()

- Add users.pdf_open_mode column via batch_alter_table (server_default='in_app')
- Create GIN expression index ix_documents_fts on documents.extracted_text via raw SQL (Alembic #1390)
- Create audit-logs MinIO bucket gated on MINIO_ENDPOINT env var
- Add MinIOBackend.put_object_raw() for caller-supplied bucket+key uploads (audit CSV export)

backend/storage/minio_backend.py

@@ -85,6 +85,28 @@ class MinIOBackend(StorageBackend):
         )
         return object_key
 
+    async def put_object_raw(
+        self,
+        bucket: str,
+        key: str,
+        data: io.BytesIO,
+        length: int,
+        content_type: str,
+    ) -> None:
+        """Upload bytes to an arbitrary bucket+key (used for audit-logs CSV export).
+
+        Unlike put_object(), does NOT apply the document key schema — the caller
+        supplies the complete key. The main documents bucket is NOT used.
+        """
+        await asyncio.to_thread(
+            self._client.put_object,
+            bucket,
+            key,
+            data,
+            length=length,
+            content_type=content_type,
+        )
+
     async def get_object(self, object_key: str) -> bytes:
         """Fetch object bytes from MinIO by key."""