fix(storage): route every file op through getStorageBackend()

Removes 12 direct minioClient.{put,get,remove}Object call sites that
bypassed the pluggable storage abstraction.  Filesystem-mode deploys
(MULTI_NODE_DEPLOYMENT=false, storage_backend=filesystem) silently
broke at every site: GDPR export, invoice PDF, EOI generation, portal
download, file upload, folder create/rename/delete, signed PDF land,
maintenance cleanup, etc.  Each site now resolves the active backend
and uses its put/get/delete + the new presignDownloadUrl() helper.

Folder marker objects in /files/folders/* keep the same on-the-wire
shape but route through the backend.  A future refactor should move
folder bookkeeping to a DB-backed virtual-folder table (see audit
HIGH §3 follow-up note in the route file).

Sites left untouched: src/lib/services/system-monitoring.service.ts
and src/app/api/ready/route.ts use minioClient.bucketExists as an S3-
specific health probe — those are correctly mode-aware and stay.

Refs: docs/audit-comprehensive-2026-05-05.md HIGH §3 (auditor-D Issue 1)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/invoices.ts

@@ -19,7 +19,8 @@ import { emitToRoom } from '@/lib/socket/server';
 import { logger } from '@/lib/logger';
 import { generatePdf } from '@/lib/pdf/generate';
 import { invoiceTemplate, buildInvoiceInputs } from '@/lib/pdf/templates/invoice-template';
-import { minioClient, buildStoragePath } from '@/lib/minio';
+import { buildStoragePath } from '@/lib/minio';
+import { getStorageBackend } from '@/lib/storage';
 import { getQueue } from '@/lib/queue';
 import { env } from '@/lib/env';
 import type {
@@ -595,13 +596,12 @@ export async function generateInvoicePdf(id: string, portId: string, meta: Audit
   const fileId = crypto.randomUUID();
   const storagePath = buildStoragePath(port?.slug ?? portId, 'invoices', id, fileId, 'pdf');
 
-  await minioClient.putObject(
-    env.MINIO_BUCKET,
-    storagePath,
-    Buffer.from(pdfBytes),
-    pdfBytes.length,
-    { 'Content-Type': 'application/pdf' },
-  );
+  const buffer = Buffer.from(pdfBytes);
+  const backend = await getStorageBackend();
+  await backend.put(storagePath, buffer, {
+    contentType: 'application/pdf',
+    sizeBytes: buffer.length,
+  });
 
   const [fileRecord] = await db
     .insert(files)