docs(news-portal): document full-online R2-only media architecture and SOP #631

Context

AWCMS-Mini already supports full-online public routing and blog_content, while Cloudflare R2 is the required object storage for the proposed news portal image workflow. This documentation issue must define the target architecture before implementation issues change storage behavior.

This scope is full-online only. It must not apply to offline/LAN deployment profiles.

Objective

Document the full-online R2-only media architecture, SOP, readiness checklist, and security/compliance guidance for news portal images.

Scope

Add documentation under:

docs/awcms-mini/news-portal/full-online-r2-architecture.md
docs/awcms-mini/news-portal/r2-upload-sop.md
docs/awcms-mini/news-portal/r2-security-checklist.md
docs/awcms-mini/news-portal/r2-incident-response.md
docs/awcms-mini/news-portal/r2-backup-lifecycle.md
docs/awcms-mini/news-portal/newsroom-user-guide.md

The docs must cover:

• Full-online-only deployment assumptions.
• Cloudflare R2-only storage rule for news images.
• PostgreSQL stores metadata only; binary images are never stored in PostgreSQL.
• No local filesystem fallback for news images.
• Direct-to-R2 or server-streaming upload flow without writing temp files to local disk.
• Presigned URL lifecycle and expiry policy.
• Object key naming convention.
• MIME validation and file extension validation.
• Checksum validation.
• CORS configuration.
• R2 custom domain and public image base URL.
• Cache-Control strategy.
• R2 credential rotation.
• Least-privilege R2 credentials.
• Incident response for leaked presigned URL, public object exposure, and malicious upload.
• Backup/lifecycle/retention policy.
• Privacy and data minimization.
• Mapping to ISO/IEC 27001, 27002, 27005, 27017, 27018, 27701, 27034, ISO 22301, OWASP ASVS, and OWASP API Security Top 10.

Out of scope

• Implementing upload API.
• Implementing R2 client code.
• Importing legacy media or legacy database rows.
• Offline/LAN image storage.
• Local upload fallback.

Acceptance criteria

• Documentation states that news image binaries must be stored only in Cloudflare R2 for full-online news portal mode.
• Documentation states that PostgreSQL stores metadata only.
• Documentation explicitly forbids local filesystem fallback for news images in full-online R2-only mode.
• SOP explains direct-to-R2 or no-local-temp server-streaming upload flow.
• Security checklist includes MIME, extension, checksum, size, object key, CORS, custom domain, and credential-rotation controls.
• Incident response covers leaked presigned URL and malicious object upload.
• Readiness checklist references config:validate, security:readiness, and production:preflight expectations.
• Docs are linked from the relevant AWCMS-Mini documentation index.

Validation

bun run docs:check
bun run check