fix: publish MinIO port in prod so the browser can actually reach it

minio had no ports: mapping at all in compose.prod.yml — only reachable
inside the docker network, never by the browser. No STORAGE_PUBLIC_URL
value could have fixed uploads without this: the browser's direct PUT
to a presigned URL has no route to the container regardless of what
hostname the URL uses. Published on STORAGE_PORT (default 9000),
mirroring how `web` is exposed via WEB_PORT for the Traefik LXC to
route to.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

compose.prod.yml

@@ -31,6 +31,12 @@ services:
       # (STORAGE_PUBLIC_URL) — without CORS allowed for that origin, the browser
       # blocks the request. Restricted to the app's own origin, not "*".
       MINIO_API_CORS_ALLOW_ORIGIN: ${BETTER_AUTH_URL}
+    ports:
+      # Published so the browser can reach MinIO directly for presigned
+      # up/downloads — same pattern as `web`'s ${WEB_PORT}: your Traefik LXC
+      # routes a (sub)domain to <this-lxc-ip>:${STORAGE_PORT}, and that public
+      # URL is what STORAGE_PUBLIC_URL must be set to.
+      - "${STORAGE_PORT:-9000}:9000"
     volumes:
       - minio_data:/data
     command: server /data --console-address ":9001"