feat: private certificates/documents buckets with SeaweedFS support

Add Document CRUD, temp→bucket commit flow, SeaweedFS env aliases, and default temp bucket name to temp.

.env.example

@@ -15,15 +15,46 @@ DEFAULT_LANG=fa
 CORS_ORIGIN=*
 UPLOAD_PATH=uploads
 
-# S3 / MinIO Private Storage Settings
+# -----------------------------------------------------------------------------
+# S3-compatible object storage
+# Local default: MinIO (docker-compose)
+# Production (SeaweedFS): set SERVICE_* / AWS_* from your host, or set S3_* directly
+# -----------------------------------------------------------------------------
+# Local MinIO example:
 S3_ENDPOINT=http://localhost:9000
 S3_REGION=us-east-1
 S3_ACCESS_KEY=minioadmin
 S3_SECRET_KEY=minioadmin
-S3_TEMP_BUCKET=gameno-temp
-S3_STORAGE_BUCKET=gameno-storage
+
+# SeaweedFS live example (preferred aliases also work without S3_*):
+# Use the public HTTPS URL (SERVICE_URL_S3). Port 8333 is often internal-only.
+# S3_ENDPOINT=https://s3.game-no.ir
+# SERVICE_URL_S3=https://s3.game-no.ir
+# SERVICE_URL_S3_8333=https://s3.game-no.ir:8333
+# SERVICE_USER_S3=...
+# SERVICE_PASSWORD_S3=...
+# AWS_ACCESS_KEY_ID=${SERVICE_USER_S3}
+# AWS_SECRET_ACCESS_KEY=${SERVICE_PASSWORD_S3}
+
+S3_TEMP_BUCKET=temp
+S3_CERTIFICATES_BUCKET=certificates
+S3_DOCUMENTS_BUCKET=documents
+S3_STORAGE_BUCKET=certificates
 S3_FORCE_PATH_STYLE=true
 SIGNED_URL_EXPIRES_IN=900
+# Private by default — set true only if a bucket is publicly readable
+S3_CERTIFICATES_PUBLIC=false
+S3_DOCUMENTS_PUBLIC=false
+# Optional public CDN/base URL used only when a bucket is public
+S3_PUBLIC_BASE_URL=
+
+# Optional SeaweedFS admin console (bucket management UI)
+# SERVICE_URL_ADMIN=https://admin-s3.game-no.ir
+# SERVICE_URL_ADMIN_23646=https://admin-s3.game-no.ir:23646
+# SERVICE_USER_ADMIN=...
+# SERVICE_PASSWORD_ADMIN=...
+# SEAWEED_USER_ADMIN=${SERVICE_USER_ADMIN}
+# SEAWEED_PASSWORD_ADMIN=${SERVICE_PASSWORD_ADMIN}
 
 # SMTP Email Configuration
 SMTP_HOST=smtp.mailtrap.io