fix(audio): sign presigned audio URLs with public MinIO endpoint

Add a second MinIO client (pub) initialized with MINIO_PUBLIC_ENDPOINT so
presigned audio URLs are signed against the public hostname from the start,
rather than signed internally and then rewritten. This avoids AWS4 signature
mismatch (SignatureDoesNotMatch 403) that occurred when the signed host was
substituted after signing.

- storage/minio.go: add PublicEndpoint/PublicUseSSL to MinioConfig; add pub
  client field; NewMinioClient creates pub client when public endpoint differs;
  PresignAudio uses pub, PresignChapter keeps internal client
- cmd/scraper/main.go: wire MINIO_PUBLIC_ENDPOINT and MINIO_PUBLIC_USE_SSL env vars
- docker-compose.yml: expose MINIO_PUBLIC_ENDPOINT and MINIO_PUBLIC_USE_SSL to scraper service
- ui/src/lib/server/minio.ts: remove rewriteHost() call from presignAudio

ui/src/lib/server/minio.ts

@@ -90,5 +90,7 @@ export async function presignAudio(
 	}
 	const data = (await res.json()) as { url: string };
 	log.debug('minio', 'presign audio ok', { slug, n });
-	return rewriteHost(data.url);
+	// The scraper now signs audio URLs with the public endpoint directly,
+	// so no host rewrite is needed here.
+	return data.url;
 }