feat(news-portal): add full-online R2-only news portal preset #632

Depends on: #631

Context

AWCMS-Mini already has blog_content, /news public routing, Module Management, Tenant Domain, and Visitor Analytics foundations. This issue adds a full-online news portal preset that requires Cloudflare R2 as the only storage backend for news images.

This issue is full-online only and must not change offline/LAN behavior.

Objective

Add a news_portal_full_online_r2 preset that configures AWCMS-Mini for a public news portal where all news images are stored only in Cloudflare R2 object storage.

Scope

Add a tenant/module preset that enables or configures:

DEPLOYMENT_PROFILE=full_online
NEWS_PORTAL_ENABLED=true
NEWS_PORTAL_PROFILE=full_online_r2
BLOG_PUBLIC_ROUTE_MODE=domain_default
BLOG_PUBLIC_BASE_PATH=/news
NEWS_IMAGE_STORAGE_POLICY=r2_only
FILE_STORAGE_DRIVER=cloudflare_r2
LOCAL_FILE_UPLOADS_ENABLED=false
LOCAL_MEDIA_STORAGE_ENABLED=false

Expected modules/profile:

blog_content
tenant_domain
visitor_analytics
module_management
identity_access

Required R2 configuration keys:

CLOUDFLARE_ACCOUNT_ID
R2_ACCESS_KEY_ID
R2_SECRET_ACCESS_KEY
R2_NEWS_IMAGE_BUCKET
R2_NEWS_IMAGE_PUBLIC_BASE_URL
R2_NEWS_IMAGE_CUSTOM_DOMAIN
R2_NEWS_IMAGE_ALLOWED_MIME_TYPES
R2_NEWS_IMAGE_MAX_BYTES
R2_NEWS_IMAGE_REQUIRE_CHECKSUM=true
R2_NEWS_IMAGE_PRESIGNED_PUT_EXPIRES_SECONDS

Out of scope

• Offline/LAN mode.
• Local upload fallback.
• Importing legacy data or media.
• Legacy route compatibility.
• R2 upload endpoint implementation.
• Media object registry schema.

Acceptance criteria

• Preset can only be activated when deployment profile is full_online.
• Preset fails readiness if FILE_STORAGE_DRIVER is not cloudflare_r2.
• Preset fails readiness if LOCAL_FILE_UPLOADS_ENABLED=true.
• Preset fails readiness if LOCAL_MEDIA_STORAGE_ENABLED=true.
• Preset fails readiness if required R2 keys are missing.
• Preset does not enable local filesystem uploads for news images.
• Preset is tenant-aware and compatible with Module Management.
• Preset changes are audited.
• .env.example documents the full-online R2-only profile.
• bun run config:validate covers the preset.
• bun run security:readiness covers the preset.
• bun run check passes.

Security notes

• R2 credentials must never be exposed to the browser.
• Preset settings must not contain secret values.
• News image binary data must not be written to local disk or PostgreSQL.
• Public image URL must be generated from trusted R2 public base URL/custom domain only.