feat: private certificates/documents buckets with SeaweedFS support

Add Document CRUD, temp→bucket commit flow, SeaweedFS env aliases, and default temp bucket name to temp.

components/files/fileService.js

@@ -1,6 +1,7 @@
 // /components/files/fileService.js
 
 const path = require('path');
+const config = require('../../config/config');
 const {
   uploadToTempBucket,
   commitTempFile,
@@ -22,7 +23,8 @@ const uploadTempFile = async (fileBuffer, originalName, mimeType) => {
   return {
     tempFileName: result.tempFileName,
     originalName,
-    mimeType
+    mimeType,
+    bucket: result.bucket
   };
 };
 
@@ -31,20 +33,23 @@ const getPresignedUrl = async (filename, bucket = null) => {
     throw new AppError('VALIDATION_FAILED', null, 'Filename is required');
   }
 
-  const signedUrl = await generatePresignedUrl(filename, bucket || undefined);
+  const targetBucket = bucket || config.S3_TEMP_BUCKET;
+  const signedUrl = await generatePresignedUrl(filename, targetBucket);
   return {
     filename,
+    bucket: targetBucket,
     presignedUrl: signedUrl,
-    expiresInSeconds: 900
+    signedUrl,
+    expiresInSeconds: config.SIGNED_URL_EXPIRES_IN
   };
 };
 
-const commitFile = async (tempFileName, targetFileName = null) => {
-  return commitTempFile(tempFileName, targetFileName);
+const commitFile = async (tempFileName, targetFileName = null, targetBucket = 'certificates') => {
+  return commitTempFile(tempFileName, targetFileName, targetBucket);
 };
 
 const deleteFile = async (filename, bucket = null) => {
-  return deleteFromBucket(filename, bucket);
+  return deleteFromBucket(filename, bucket || config.S3_TEMP_BUCKET);
 };
 
 module.exports = {