feat(api): idempotent upload session init with presigned credential

POST /v1/uploads (Task 18, A03): @@unique(userId, clientTaskId) idempotency
anchor — same params return the original session (201, no duplicate photo);
param drift (album/bytes/contentType/extension) -> 409 UPLOAD_SESSION_CONFLICT.
photos.objectKey is set to the FINAL originals key at init while the session
holds the staging key; IDs come from an app-side cuid-like generator so both
self-referencing keys are written in one transaction. Credential is a real
MinIO presigned PUT (SIGNED_URL_TTL_SECONDS, lazily read). Permission order:
album invisible 404 -> member 403 -> uploadEnabled 409 -> size/ext 400 ->
category ownership 400. No audit on init (audit anchors on complete).

Pre-step for Task 19: QUEUE_PHOTO_PROCESS contract constant + lazy-safe
BullMQ queue producer (Redis down at boot must not crash the app; enqueue
failure only logs — sweep compensates). e2e reset now also wipes the MinIO
photo-live/dev prefix; jest maps @photo/storage to TS source.

Co-Authored-By: Claude Code <noreply@anthropic.com>

services/api/jest.config.ts

@@ -27,6 +27,9 @@ const config: Config = {
   moduleNameMapper: {
     '^@photo/contracts$': '<rootDir>/../../packages/contracts/src/index.ts',
     '^@photo/db-cn$': '<rootDir>/../../packages/db-cn/src/index.ts',
+    // Task 18 起：@photo/storage 同样映射到 TS 源码（其依赖 @aws-sdk/* 与
+    // @photo/contracts 分别从 storage 包 node_modules / 上面的映射解析）。
+    '^@photo/storage$': '<rootDir>/../../packages/storage/src/index.ts',
     '^(\\.{1,2}/.*)\\.js$': '$1',
   },
   // test/ 下的 *.spec.ts 为直连真实 DB 的集成型单测（seed.spec.ts、