- attachments: filesystem-on-PVC recommended, blob interface keeps MinIO
as a later drop-in; size limits via admin setting; sniffed-mime +
nosniff/sandbox serving rules
- storage backend: stay SQLite-only (WAL, modernc); no Postgres/Redis and
no backend abstraction until documented trigger conditions fire
