Implement backend API and database services in Docker setup

- Added a new `api` service for the NestJS backend, including health checks and dependencies on PostgreSQL, Redis, and MinIO.
- Introduced PostgreSQL and Redis services with health checks and configurations for data persistence.
- Added MinIO for S3-compatible object storage and a one-shot service to initialize required buckets.
- Updated the Nginx configuration to proxy requests to the new backend API and MinIO storage.
- Enhanced the Dockerfile to support the new API environment variables and configurations.
- Updated the `package.json` and `package-lock.json` to include new dependencies for QR code generation and other utilities.

Co-authored-by: Cursor <cursoragent@cursor.com>

nginx.conf

@@ -8,7 +8,7 @@ server {
     gzip on;
     gzip_vary on;
     gzip_min_length 1024;
-    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json;
+    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json application/vnd.apple.mpegurl video/MP2T;
 
     # Security headers
     add_header X-Frame-Options "SAMEORIGIN" always;
@@ -27,7 +27,59 @@ server {
         add_header Cache-Control "public, immutable";
     }
 
-    # WebSocket proxy to Nostr relay (Docker service)
+    # ── Backend API proxy ──────────────────────────────────────
+    location /api/ {
+        resolver 127.0.0.11 valid=30s ipv6=off;
+        set $api_upstream http://api:4000;
+
+        rewrite ^/api(.*) $1 break;
+        proxy_pass $api_upstream;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+
+        # Handle large uploads
+        client_max_body_size 100m;
+    }
+
+    # ── MinIO storage proxy (public bucket) ────────────────────
+    # Serves poster images, HLS segments, etc. with caching
+    location /storage/ {
+        resolver 127.0.0.11 valid=30s ipv6=off;
+        set $minio_upstream http://minio:9000;
+
+        rewrite ^/storage/(.*) /indeedhub-public/$1 break;
+        proxy_pass $minio_upstream;
+        proxy_http_version 1.1;
+        proxy_set_header Host minio:9000;
+
+        # Cache static assets aggressively
+        proxy_cache_valid 200 1d;
+        proxy_cache_valid 404 1m;
+        expires 1d;
+        add_header Cache-Control "public, max-age=86400";
+        add_header X-Cache-Status $upstream_cache_status;
+    }
+
+    # ── MinIO storage proxy (private bucket -- for HLS key delivery) ─
+    location /storage-private/ {
+        resolver 127.0.0.11 valid=30s ipv6=off;
+        set $minio_upstream http://minio:9000;
+
+        rewrite ^/storage-private/(.*) /indeedhub-private/$1 break;
+        proxy_pass $minio_upstream;
+        proxy_http_version 1.1;
+        proxy_set_header Host minio:9000;
+
+        # Do NOT cache private content
+        add_header Cache-Control "no-store";
+    }
+
+    # ── WebSocket proxy to Nostr relay (Docker service) ────────
     location /relay {
         resolver 127.0.0.11 valid=30s ipv6=off;
         set $relay_upstream http://relay:8080;
@@ -43,7 +95,7 @@ server {
         proxy_send_timeout 86400s;
     }
 
-    # Vue Router - SPA fallback
+    # ── Vue Router - SPA fallback ──────────────────────────────
     location / {
         try_files $uri $uri/ /index.html;
     }