feat(storage): replace Azure Blob with on-prem MinIO/S3 (cutover)

.env.example

@@ -257,7 +257,20 @@ AZURE_CLIENT_ID=
 AZURE_CLIENT_SECRET=
 AZURE_TENANT_ID=
 AZURE_SUBSCRIPTION_ID=
-AZURE_STORAGE_CONNECTION_STRING=
+
+# S3-compatible object storage (on-prem MinIO) — replacement for Azure Blob.
+# endpoint/region/publicUrl are non-secret and belong in the deploy compose environment, not here;
+# accessKey/secretKey are app credentials (secret -> vault in real environments).
+S3_ENDPOINT=
+S3_REGION=
+S3_ACCESS_KEY=
+S3_SECRET_KEY=
+S3_PUBLIC_URL=
+
+# Provisioning-only S3 credentials (broader admin policy) used solely by
+# scripts/storage/provision-bucket.ts — never used by the running app. Secret -> vault.
+S3_ADMIN_ACCESS_KEY=
+S3_ADMIN_SECRET_KEY=
 
 # OpenTelemetry trace export (OTLP/HTTP). Point this at an OTLP collector to
 # enable distributed tracing; leave empty to disable. e.g. http://localhost:4318

migration/1784103600000-AddArchiveAnchoring.js

@@ -0,0 +1,34 @@
+/**
+ * @typedef {import('typeorm').MigrationInterface} MigrationInterface
+ * @typedef {import('typeorm').QueryRunner} QueryRunner
+ */
+
+/**
+ * @class
+ * @implements {MigrationInterface}
+ */
+module.exports = class AddArchiveAnchoring1784103600000 {
+    name = 'AddArchiveAnchoring1784103600000'
+
+    /**
+     * @param {QueryRunner} queryRunner
+     */
+    async up(queryRunner) {
+        await queryRunner.query(`CREATE TABLE "archive_batch" ("id" SERIAL NOT NULL, "updated" TIMESTAMP NOT NULL DEFAULT now(), "created" TIMESTAMP NOT NULL DEFAULT now(), "merkleRoot" character varying(64) NOT NULL, "otsProof" text, "bitcoinHeight" integer, "status" character varying(256) NOT NULL DEFAULT 'pendingBtc', CONSTRAINT "PK_06f898016522a01c619a214aa18" PRIMARY KEY ("id"))`);
+        await queryRunner.query(`CREATE TABLE "archive_file" ("id" SERIAL NOT NULL, "updated" TIMESTAMP NOT NULL DEFAULT now(), "created" TIMESTAMP NOT NULL DEFAULT now(), "bucket" text NOT NULL, "name" text NOT NULL, "sha256" character varying(64) NOT NULL, "leafIndex" integer, "merkleProof" text, "batchId" integer, CONSTRAINT "PK_17e252452a46a911a66d67dd50d" PRIMARY KEY ("id"))`);
+        await queryRunner.query(`CREATE UNIQUE INDEX "IDX_e7da94bafd8e348ead75dcb000" ON "archive_file" ("bucket", "name") `);
+        await queryRunner.query(`CREATE INDEX "IDX_4065eeb67cf015dc7327499de9" ON "archive_file" ("batchId") `);
+        await queryRunner.query(`ALTER TABLE "archive_file" ADD CONSTRAINT "FK_4065eeb67cf015dc7327499de94" FOREIGN KEY ("batchId") REFERENCES "archive_batch"("id") ON DELETE NO ACTION ON UPDATE NO ACTION`);
+    }
+
+    /**
+     * @param {QueryRunner} queryRunner
+     */
+    async down(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "archive_file" DROP CONSTRAINT "FK_4065eeb67cf015dc7327499de94"`);
+        await queryRunner.query(`DROP INDEX "public"."IDX_4065eeb67cf015dc7327499de9"`);
+        await queryRunner.query(`DROP INDEX "public"."IDX_e7da94bafd8e348ead75dcb000"`);
+        await queryRunner.query(`DROP TABLE "archive_file"`);
+        await queryRunner.query(`DROP TABLE "archive_batch"`);
+    }
+}