feat(storage): add public endpoint support for presigned URLs

When services run in Docker with internal endpoints (e.g., http://minio:9000),
presigned URLs are inaccessible from browsers. This adds S3_PUBLIC_ENDPOINT
support to generate presigned URLs using a publicly accessible endpoint
(e.g., https://minio.mana.how) while keeping internal operations on the
Docker network.

Changes:
- Add publicEndpoint to StorageConfig type
- Create separate S3Client for presigned URL generation
- Add S3_PUBLIC_ENDPOINT to factory configuration
- Configure lightwrite-backend with public MinIO endpoint

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docker-compose.macmini.yml

@@ -609,6 +609,7 @@ services:
       MANA_CORE_AUTH_URL: http://mana-auth:3001
       CORS_ORIGINS: https://lightwrite.mana.how,https://mana.how
       S3_ENDPOINT: http://minio:9000
+      S3_PUBLIC_ENDPOINT: https://minio.mana.how
       S3_REGION: us-east-1
       S3_ACCESS_KEY: ${MINIO_ACCESS_KEY:-minioadmin}
       S3_SECRET_KEY: ${MINIO_SECRET_KEY:-minioadmin}