[self-host][mobile]s3: add public_endpoint for LAN/mobile self-hosting

[ktpa]

Description

When self-hosting on a LAN with the MinIO quickstart setup, pre-signed S3 URLs are generated using the same endpoint museum uses for its own internal S3 calls. The quickstart routes internal calls through socat (endpoint: localhost:3200), which works for HeadObject, but that localhost address ends up in the pre-signed URLs handed to clients. On a mobile device or any machine other than the server, localhost resolves to the device itself, so uploads from external clients silently fail: the file never reaches MinIO and museum's subsequent HeadObject returns a timeout.

This adds an optional public_endpoint field per S3 bucket. When set, museum creates a second S3 client using that address exclusively for generating pre-signed URLs. All direct S3 API calls (HeadObject, CreateMultipartUpload, etc.) continue using endpoint. If public_endpoint is not set, behaviour is identical to before.

The change is documented in local.yaml and quickstart.sh with the common case: endpoint: localhost:3200 (socat, unchanged) and public_endpoint: 192.168.1.100:3200 (the server's LAN IP, for clients).

Tests

Manually verified on a self-hosted instance running the quickstart Docker Compose setup, with an iOS client on the same LAN. Before this change, all uploads from the iOS app failed silently: museum logged OBJECT_SIZE_FETCH_FAILED: dial tcp LAN-IP:3200: i/o timeout on every commit attempt.

After setting endpoint: minio:3200 and public_endpoint: LAN-IP:3200, the iOS app backed up successfully.

No existing behaviour is affected when public_endpoint is omitted.

[CLAassistant]

All committers have signed the CLA.