feat: private certificates/documents buckets with SeaweedFS support

Add Document CRUD, temp→bucket commit flow, SeaweedFS env aliases, and default temp bucket name to temp.

components/documents/documentModel.js

@@ -0,0 +1,56 @@
+// /components/documents/documentModel.js
+
+const mongoose = require('mongoose');
+
+const documentSchema = new mongoose.Schema({
+  user: {
+    type: mongoose.Schema.Types.ObjectId,
+    ref: 'User',
+    required: true,
+    index: true
+  },
+  title: {
+    type: String,
+    required: true,
+    trim: true
+  },
+  description: {
+    type: String,
+    trim: true,
+    default: ''
+  },
+  /** Permanent object key inside the documents bucket */
+  fileKey: {
+    type: String,
+    required: true,
+    trim: true
+  },
+  /** Original uploaded filename */
+  fileName: {
+    type: String,
+    trim: true
+  },
+  /** Public URL only when the documents bucket is public; otherwise null */
+  fileUrl: {
+    type: String,
+    trim: true,
+    default: null
+  },
+  bucket: {
+    type: String,
+    trim: true,
+    default: 'documents'
+  },
+  mimeType: {
+    type: String,
+    trim: true
+  },
+  uploadedBy: {
+    type: mongoose.Schema.Types.ObjectId,
+    ref: 'User'
+  }
+}, {
+  timestamps: true
+});
+
+module.exports = mongoose.model('Document', documentSchema);