feat(api): idempotent upload session init with presigned credential

POST /v1/uploads (Task 18, A03): @@unique(userId, clientTaskId) idempotency
anchor — same params return the original session (201, no duplicate photo);
param drift (album/bytes/contentType/extension) -> 409 UPLOAD_SESSION_CONFLICT.
photos.objectKey is set to the FINAL originals key at init while the session
holds the staging key; IDs come from an app-side cuid-like generator so both
self-referencing keys are written in one transaction. Credential is a real
MinIO presigned PUT (SIGNED_URL_TTL_SECONDS, lazily read). Permission order:
album invisible 404 -> member 403 -> uploadEnabled 409 -> size/ext 400 ->
category ownership 400. No audit on init (audit anchors on complete).

Pre-step for Task 19: QUEUE_PHOTO_PROCESS contract constant + lazy-safe
BullMQ queue producer (Redis down at boot must not crash the app; enqueue
failure only logs — sweep compensates). e2e reset now also wipes the MinIO
photo-live/dev prefix; jest maps @photo/storage to TS source.

Co-Authored-By: Claude Code <noreply@anthropic.com>

services/api/package.json

@@ -20,8 +20,11 @@
     "@node-rs/argon2": "^2.2.1",
     "@photo/contracts": "workspace:*",
     "@photo/db-cn": "workspace:*",
+    "@photo/storage": "workspace:^",
+    "bullmq": "^6.3.6",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.15.1",
+    "ioredis": "^6.0.0",
     "nestjs-pino": "^4.6.1",
     "pino": "^10.0.0",
     "pino-http": "^11.0.0",
@@ -29,6 +32,7 @@
     "rxjs": "^7.8.1"
   },
   "devDependencies": {
+    "@aws-sdk/client-s3": "^3.700.0",
     "@nestjs/testing": "^10.4.6",
     "@types/jest": "^29.5.13",
     "@types/node": "^22.10.0",