Remove host publish of file-storage internal port 8080

[HermanPlay]

Context

Duplicate of file-storage security concern (see file-storage repo): the unauthenticated internal server must not be host-published.

Problem

docker-compose/docker-compose.yaml file-storage service:

ports:
  - "8888:8888"  # public server (for signed URL access)
  - "8080:8080"  # internal server (for backend/worker)

8080:8080 exposes the internal API (object read/write/delete, /sign URL minting, no auth) to the host. Keep 8888:8888 public, drop the internal publish; backend/worker reach it via docker network (file-storage:8080).

Note: docker-compose.dev.yaml (untracked) already omits published ports for file-storage — align prod with it.

Required changes

• Remove 8080:8080 from prod compose file-storage ports.
• Confirm backend FILE_STORAGE_PORT=8080 and worker STORAGE_PORT=8080 still resolve container-to-container.

Acceptance criteria

• curl localhost:8080/... from host refused; signed GET via 8888/nginx /files/ works; backend + worker function.