Add admin UI + MinIO image uploads

- Admin API: list/edit posts (incl. drafts, raw markdown), moderate comments, subscribers,
  author bio/links, and presigned image upload to MinIO (bucket is public-read for covers).
- Admin UI at /admin: post editor with cover-image upload, comment moderation, subscriber list.
- Public security switched to authenticated-paths so static assets (/images, /data) stay public.

Dockerfile

@@ -1,37 +0,0 @@
-# syntax=docker/dockerfile:1
-
-# ---------- build ----------
-FROM maven:3.9-eclipse-temurin-25 AS build
-WORKDIR /src
-COPY . .
-# Resolve the platform from the Gitea Maven registry (creds via BuildKit secrets); the Maven build also
-# runs the Vite/React SPA build (frontend-maven-plugin) and folds it into the jar. Tests are skipped here
-# because Testcontainers needs a Docker daemon — they run via `mvn verify`, not in the image build.
-RUN --mount=type=secret,id=maven_user --mount=type=secret,id=maven_token \
-    MAVEN_USER="$(cat /run/secrets/maven_user)" MAVEN_TOKEN="$(cat /run/secrets/maven_token)" \
-    mvn -B -ntp -s .gitea/ci-settings.xml -DskipTests package \
- && cp "$(ls target/confessions-of-grace-*.jar | grep -v original | head -1)" app.jar \
- && java -Djarmode=tools -jar app.jar extract --layers --destination extracted
-
-# ---------- runtime ----------
-FROM eclipse-temurin:25-jre-alpine AS runtime
-RUN apk -U upgrade --no-cache && apk add --no-cache curl
-RUN addgroup -S spring && adduser -S -D -H -h /app -s /sbin/nologin -G spring spring
-WORKDIR /app
-
-COPY --from=build --chown=spring:spring /src/extracted/dependencies/ ./
-COPY --from=build --chown=spring:spring /src/extracted/snapshot-dependencies/ ./
-COPY --from=build --chown=spring:spring /src/extracted/application/ ./
-
-USER spring
-EXPOSE 8080
-
-HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
-  CMD curl -fsS http://localhost:8080/actuator/health || exit 1
-
-ARG GIT_SHA=unknown
-LABEL org.opencontainers.image.title="confessions-of-grace" \
-      org.opencontainers.image.source="https://git.thebennett.net/reformedwitness/confessions-of-grace" \
-      org.opencontainers.image.revision="${GIT_SHA}"
-
-ENTRYPOINT ["java", "-XX:MaxRAMPercentage=75.0", "-jar", "app.jar"]