feat(api-water): 支持上传水印图片

docs/guides/minio-local-deployment.md

@@ -90,12 +90,13 @@ NestJS API/Worker 通过环境变量拿到连接信息，本地 `.env` 示例：
 
 ```bash
 # 对象存储（本地 MinIO / 生产 Kodo 只换这一组值）
-S3_ENDPOINT=http://localhost:9000
-S3_REGION=us-east-1            # MinIO 不校验 region，任意合法值即可
-S3_BUCKET=atlas-dev-assets
-S3_ACCESS_KEY=atlas-dev
-S3_SECRET_KEY=atlas-dev-secret
-S3_FORCE_PATH_STYLE=true       # MinIO 必须用 path-style，见第 6.3 节
+OBJECT_STORAGE_ENDPOINT=http://localhost:9000
+OBJECT_STORAGE_BUCKET=atlas-dev-assets
+OBJECT_STORAGE_FORCE_PATH_STYLE=true
+# 生产或共享环境必须提供专用最小权限凭证：
+OBJECT_STORAGE_ACCESS_KEY=atlas-dev
+OBJECT_STORAGE_SECRET_KEY=atlas-dev-secret
+# 本地也可仅设置 MINIO_ROOT_USER / MINIO_ROOT_PASSWORD，由 API 作为兼容回退读取。
 ```
 
 ## 4. 创建 Bucket
@@ -159,24 +160,24 @@ import { S3Client, GetObjectCommand, PutObjectCommand } from '@aws-sdk/client-s3
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
 
 const s3 = new S3Client({
-  endpoint: process.env.S3_ENDPOINT!,       // http://localhost:9000
-  region: process.env.S3_REGION!,           // MinIO 任意值即可
+  endpoint: process.env.OBJECT_STORAGE_ENDPOINT!, // http://localhost:9000
+  region: 'us-east-1',
   credentials: {
-    accessKeyId: process.env.S3_ACCESS_KEY!,
-    secretAccessKey: process.env.S3_SECRET_KEY!,
+    accessKeyId: process.env.OBJECT_STORAGE_ACCESS_KEY!,
+    secretAccessKey: process.env.OBJECT_STORAGE_SECRET_KEY!,
   },
-  forcePathStyle: true,                     // MinIO 必须；Kodo 走虚拟主机式，配置驱动即可
+  forcePathStyle: process.env.OBJECT_STORAGE_FORCE_PATH_STYLE === 'true',
 });
 
 // 预签名上传 URL：前端拿到后直传，浏览器不保存永久密钥
 export async function presignUpload(objectKey: string, contentType: string) {
-  const cmd = new PutObjectCommand({ Bucket: process.env.S3_BUCKET, Key: objectKey, ContentType: contentType });
+  const cmd = new PutObjectCommand({ Bucket: process.env.OBJECT_STORAGE_BUCKET, Key: objectKey, ContentType: contentType });
   return getSignedUrl(s3, cmd, { expiresIn: 600 }); // 10 分钟
 }
 
 // 预签名下载 URL：预览/下载私有文件
 export async function presignDownload(objectKey: string) {
-  const cmd = new GetObjectCommand({ Bucket: process.env.S3_BUCKET, Key: objectKey });
+  const cmd = new GetObjectCommand({ Bucket: process.env.OBJECT_STORAGE_BUCKET, Key: objectKey });
   return getSignedUrl(s3, cmd, { expiresIn: 900 }); // 15 分钟
 }
 ```