fix(storage): route every file op through getStorageBackend()

Removes 12 direct minioClient.{put,get,remove}Object call sites that
bypassed the pluggable storage abstraction.  Filesystem-mode deploys
(MULTI_NODE_DEPLOYMENT=false, storage_backend=filesystem) silently
broke at every site: GDPR export, invoice PDF, EOI generation, portal
download, file upload, folder create/rename/delete, signed PDF land,
maintenance cleanup, etc.  Each site now resolves the active backend
and uses its put/get/delete + the new presignDownloadUrl() helper.

Folder marker objects in /files/folders/* keep the same on-the-wire
shape but route through the backend.  A future refactor should move
folder bookkeeping to a DB-backed virtual-folder table (see audit
HIGH §3 follow-up note in the route file).

Sites left untouched: src/lib/services/system-monitoring.service.ts
and src/app/api/ready/route.ts use minioClient.bucketExists as an S3-
specific health probe — those are correctly mode-aware and stay.

Refs: docs/audit-comprehensive-2026-05-05.md HIGH §3 (auditor-D Issue 1)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/storage/index.ts

@@ -194,6 +194,24 @@ async function buildBackend(cfg: StorageConfigSnapshot): Promise<StorageBackend>
   });
 }
 
+// ─── url helpers ────────────────────────────────────────────────────────────
+
+/**
+ * Convenience wrapper that returns just the presigned download URL — the most
+ * common need at call sites that don't track expiry. Mirrors the legacy
+ * `getPresignedUrl(key)` helper in `@/lib/minio` but routes through the
+ * active backend so filesystem-mode deployments work too.
+ */
+export async function presignDownloadUrl(
+  key: string,
+  expirySeconds = 900,
+  filename?: string,
+): Promise<string> {
+  const backend = await getStorageBackend();
+  const { url } = await backend.presignDownload(key, { expirySeconds, filename });
+  return url;
+}
+
 // ─── re-exports ─────────────────────────────────────────────────────────────
 
 export { S3Backend } from './s3';