fix: MinIO CORS blocking browser uploads, changelog admin-only

- MinIO had no CORS config at all, so the browser's direct PUT to a
  presigned URL (cross-origin: app on :3001/:3000, storage on :9000)
  was blocked outright. Added MINIO_API_CORS_ALLOW_ORIGIN — "*" in
  dev, the app's own origin in prod. Verified end-to-end: photo
  upload now succeeds with zero console errors.
- Removed the public /changelog page and its account-menu link —
  changelog is admin-only now (/admin/changelog).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/(app)/changelog/page.tsx

@@ -1,19 +0,0 @@
-import type { Metadata } from "next";
-import { ChangelogList } from "@/components/shared/changelog-list";
-import { APP_VERSION } from "@/lib/changelog";
-
-export const metadata: Metadata = {};
-
-export default function ChangelogPage() {
-  return (
-    <div className="space-y-2">
-      <div>
-        <h1 className="text-3xl font-bold tracking-tight">Changelog</h1>
-        <p className="text-muted-foreground mt-1">Currently running v{APP_VERSION}.</p>
-      </div>
-      <div className="pt-4">
-        <ChangelogList />
-      </div>
-    </div>
-  );
-}

apps/web/components/layout/nav.tsx

@@ -3,7 +3,7 @@
 import Link from "next/link";
 import { usePathname, useRouter } from "next/navigation";
 import { useTheme } from "next-themes";
-import { BookOpen, Calendar, Package, ChefHat, User, Rss, FolderOpen, ShoppingCart, Shield, Search, Compass, Menu, Sun, Moon, Monitor, Apple, History } from "lucide-react";
+import { BookOpen, Calendar, Package, ChefHat, User, Rss, FolderOpen, ShoppingCart, Shield, Search, Compass, Menu, Sun, Moon, Monitor, Apple } from "lucide-react";
 import { cn } from "@/lib/utils";
 import { Button, buttonVariants } from "@/components/ui/button";
 import {
@@ -131,12 +131,6 @@ export function Nav() {
               <DropdownMenuItem>
                 <Link href="/settings" className="w-full">{t("settings")}</Link>
               </DropdownMenuItem>
-              <DropdownMenuItem>
-                <Link href="/changelog" className="w-full flex items-center gap-2">
-                  <History className="h-3.5 w-3.5 text-muted-foreground" />
-                  {t("changelog")}
-                </Link>
-              </DropdownMenuItem>
               <div
                 role="group"
                 aria-label={t("systemMode")}

apps/web/messages/en.json

@@ -11,7 +11,6 @@
     "pantry": "Pantry",
     "shopping": "Shopping",
     "settings": "Settings",
-    "changelog": "Changelog",
     "admin": "Admin",
     "signOut": "Sign out",
     "apiKeys": "API keys",

apps/web/messages/fr.json

@@ -11,7 +11,6 @@
     "pantry": "Garde-manger",
     "shopping": "Courses",
     "settings": "Paramètres",
-    "changelog": "Journal des modifications",
     "admin": "Admin",
     "signOut": "Se déconnecter",
     "apiKeys": "Clés API",

compose.prod.yml

@@ -27,6 +27,10 @@ services:
     environment:
       MINIO_ROOT_USER: ${MINIO_ROOT_USER}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+      # The browser PUTs photo uploads directly to MinIO using a presigned URL
+      # (STORAGE_PUBLIC_URL) — without CORS allowed for that origin, the browser
+      # blocks the request. Restricted to the app's own origin, not "*".
+      MINIO_API_CORS_ALLOW_ORIGIN: ${BETTER_AUTH_URL}
     volumes:
       - minio_data:/data
     command: server /data --console-address ":9001"

compose.yml

@@ -40,6 +40,10 @@ services:
     environment:
       MINIO_ROOT_USER: minioadmin
       MINIO_ROOT_PASSWORD: minioadmin
+      # The browser PUTs photo uploads directly to MinIO using a presigned URL,
+      # which is cross-origin from the Next.js app (different port) — without
+      # this, the browser blocks the request with a CORS error.
+      MINIO_API_CORS_ALLOW_ORIGIN: "*"
     ports:
       - "9000:9000"
       - "9001:9001"