Verify M2/M3 implementation, fix regressions against M0/M1

Regressions fixed:
- gateway/src/worker.rs: missing session_manager field in AuthState (M3 regression)
- gateway/src/main.rs: same missing field in monolithic gateway
- storage/src/handlers.rs: removed unused validate_role (now handled by RlsTransaction)

M2 Storage Pillar — verified complete:
- StorageBackend trait with full API (put/get/delete/copy/head/list/multipart)
- AwsS3Backend implementation with streaming get_object
- StorageMode enum (Cloud/SelfHosted) in Config
- All routes: CRUD buckets, CRUD objects, copy, move, sign, public URL, health
- Bucket constraints: file_size_limit + allowed_mime_types enforced on upload
- TUS resumable uploads with S3 multipart (5MB chunking)
- Image transforms run via spawn_blocking
- docker-compose.pillar-storage.yml, templates/storage-node.yaml
- Shared Docker network on all pillar compose files

M3 Auth Completeness — verified complete:
- POST /logout revokes refresh tokens + Redis sessions
- GET /settings returns provider availability
- POST /magiclink with hashed token storage
- DELETE /user soft-delete with token revocation
- Recovery flow accepts new password
- Email change requires re-verification via token
- OAuth callback redirects with fragment tokens
- MFA verify returns aal2 JWT with amr claims
- MFA challenge validates factor ownership
- SessionManager wired into login/logout
- GET /sessions returns active sessions
- Configurable ACCESS_TOKEN_LIFETIME
- Claims model extended with session_id, aal, amr

Tests: 62 passed, 0 failed, 11 ignored (external services)
Warnings: 0
Made-with: Cursor

templates/storage-node.yaml

@@ -0,0 +1,28 @@
+id: storage-node
+name: Dedicated Storage Node
+description: MinIO object storage for self-hosted deployments
+version: 1.0
+
+min_hetzner_plan: CX21
+estimated_monthly_cost: 6.94
+
+services:
+  - id: minio
+    name: MinIO
+    image: quay.io/minio/minio:RELEASE.2024-06-13T22-53-53Z
+    ports: ["9000:9000", "9001:9001"]
+    command: ["server", "/data", "--console-address", ":9001"]
+    volumes:
+      - minio_data:/data
+    resource_profile: storage_intensive
+
+requirements:
+  min_nodes: 1
+  max_nodes: 4
+  supports_ha: true
+  recommended_deployment: "Dedicated node with attached block storage"
+
+notes: |
+  For HA, use distributed MinIO with 4+ nodes and erasure coding.
+  For cloud deployments, skip this node — use Hetzner Object Storage.
+  Estimated storage: 1TB on CX21 block storage = ~€6/mo additional.