fix(media): replace hardcoded MinIO creds and raw fetch with S3 SDK

- Remove `minioadmin` fallback credentials — app now throws on missing
  MINIO_ACCESS_KEY / MINIO_SECRET_KEY env vars
- Replace raw fetch() PUT/DELETE with @aws-sdk/client-s3 (PutObject,
  DeleteObject) using AWS Signature V4 auth
- Add OnModuleInit bucket existence check + auto-creation
- Use forcePathStyle for MinIO S3 compatibility

Closes TEC-1452

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/package.json

@@ -13,6 +13,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.1026.0",
     "@goodgo/mcp-servers": "workspace:*",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",