refactor(storage): remove MinIO backend, filesystem-only storage

Remove the MinIO/S3 storage backend entirely. The filesystem backend is
fully implemented, already used in production, and a migrate-storage tool
exists for any remaining MinIO deployments to migrate beforehand.

Changes:
- Delete MinIO client implementation (internal/storage/storage.go)
- Delete migrate-storage tool (cmd/migrate-storage, scripts/migrate-storage.sh)
- Remove MinIO service, volumes, and env vars from all Docker Compose files
- Simplify StorageConfig: remove Endpoint, AccessKey, SecretKey, Bucket,
  UseSSL, Region fields; add SILO_STORAGE_ROOT_DIR env override
- Change all SQL COALESCE defaults from 'minio' to 'filesystem'
- Add migration 020 to update column defaults to 'filesystem'
- Remove minio-go/v7 dependency (go mod tidy)
- Update all config examples, setup scripts, docs, and tests

deployments/docker-compose.allinone.yaml

@@ -1,5 +1,5 @@
 # Silo All-in-One Stack
-# PostgreSQL + MinIO + OpenLDAP + Silo API + Nginx (optional)
+# PostgreSQL + OpenLDAP + Silo API + Nginx (optional)
 #
 # Quick start:
 #   ./scripts/setup-docker.sh
@@ -40,29 +40,6 @@ services:
     networks:
       - silo-net
 
-  # ---------------------------------------------------------------------------
-  # MinIO (S3-compatible object storage)
-  # ---------------------------------------------------------------------------
-  minio:
-    image: minio/minio:latest
-    container_name: silo-minio
-    restart: unless-stopped
-    command: server /data --console-address ":9001"
-    environment:
-      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY:?Run ./scripts/setup-docker.sh first}
-      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY:?Run ./scripts/setup-docker.sh first}
-    volumes:
-      - minio_data:/data
-    ports:
-      - "9001:9001"           # MinIO console (remove in hardened setups)
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    networks:
-      - silo-net
-
   # ---------------------------------------------------------------------------
   # OpenLDAP (user directory for LDAP authentication)
   # ---------------------------------------------------------------------------
@@ -83,9 +60,13 @@ services:
       - openldap_data:/bitnami/openldap
       - ./ldap:/docker-entrypoint-initdb.d:ro
     ports:
-      - "1389:1389"           # LDAP access for debugging (remove in hardened setups)
+      - "1389:1389" # LDAP access for debugging (remove in hardened setups)
     healthcheck:
-      test: ["CMD-SHELL", "ldapsearch -x -H ldap://localhost:1389 -b dc=silo,dc=local -D cn=admin,dc=silo,dc=local -w $${LDAP_ADMIN_PASSWORD} '(objectClass=organization)' >/dev/null 2>&1"]
+      test:
+        [
+          "CMD-SHELL",
+          "ldapsearch -x -H ldap://localhost:1389 -b dc=silo,dc=local -D cn=admin,dc=silo,dc=local -w $${LDAP_ADMIN_PASSWORD} '(objectClass=organization)' >/dev/null 2>&1",
+        ]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -104,8 +85,6 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
-      minio:
-        condition: service_healthy
       openldap:
         condition: service_healthy
     env_file:
@@ -117,12 +96,10 @@ services:
       SILO_DB_NAME: silo
       SILO_DB_USER: silo
       SILO_DB_PASSWORD: ${POSTGRES_PASSWORD}
-      SILO_MINIO_ENDPOINT: minio:9000
-      SILO_MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY}
-      SILO_MINIO_SECRET_KEY: ${MINIO_SECRET_KEY}
     ports:
       - "${SILO_PORT:-8080}:8080"
     volumes:
+      - silo_data:/var/lib/silo/data
       - ../schemas:/etc/silo/schemas:ro
       - ./config.docker.yaml:/etc/silo/config.yaml:ro
     healthcheck:
@@ -164,7 +141,7 @@ services:
 
 volumes:
   postgres_data:
-  minio_data:
+  silo_data:
   openldap_data:
 
 networks: