feat(storage): support public MinIO reverse-proxy URLs

[Nickszy]

Summary

Allow deployments that keep MinIO private and expose objects through an application reverse proxy.

• Add optional MINIO_PUBLIC_URI (for example https://yuxi.example.com/storage).
• Generate uploaded object URLs from that public base rather than exposing :9000.
• Accept only the configured public host and prefix when downloading one of those URLs back into a temporary file.
• Preserve current HOST_IP / localhost behavior when MINIO_PUBLIC_URI is unset.

Why

Many production deployments do not publish MinIO directly. Returning http://<host>:9000/... produces inaccessible or mixed-origin URLs; the configurable public base allows same-origin reverse-proxy deployments without weakening URL validation.

Tests

TEST_USERNAME=unit-test TEST_PASSWORD=unit-test .venv/Scripts/python.exe -m pytest test/test_minio_public_uri.py -q
# 4 passed
.venv/Scripts/ruff.exe check src/storage/minio/client.py test/test_minio_public_uri.py
# All checks passed

The focused test module loads the storage client without importing the application's eager graph bootstrap, so it has no Neo4j dependency.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[Nickszy]

关闭此版本：上游 main 已在 #852 后引入 MINIO_PUBLIC_URL=/minio 的同源反代方案，覆盖了本 PR 的主要功能且目录重构导致实现冲突。我会基于当前架构另提一个仅修复 URL 校验/前缀解析的最小 PR，避免重复功能。