feat(storage): add S3 backend support and advanced upload limits

- Introduce S3-compatible storage backend support using minio-go.
- Add configuration options for local storage limits, box limits, and rate limiting.
- Implement storage backend selection (local vs S3) for anonymous and registered users.
- Add an `/admin/storage` management interface.
- Update documentation and environment examples with the new configuration variables.

backend/templates/pages/auth.html

@@ -9,6 +9,7 @@
         <h1 id="auth-title">Create the admin account</h1>
         <p class="muted-copy">The first user becomes the instance admin. Registration closes after this account is created.</p>
         <form class="stack-form" action="/register" method="post">
+          <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
           {{if .Data.Error}}<p class="form-error">{{.Data.Error}}</p>{{end}}
           <label><span>Username</span><input name="username" autocomplete="username" required></label>
           <label><span>Email</span><input type="email" name="email" autocomplete="email" required></label>
@@ -20,6 +21,7 @@
         <h1 id="auth-title">{{if .Data.IsReset}}Choose a new password{{else}}Create your account{{end}}</h1>
         {{if .Data.Email}}<p class="muted-copy">{{.Data.Email}}</p>{{end}}
         <form class="stack-form" action="/invite/{{.Data.Token}}" method="post">
+          <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
           {{if .Data.Error}}<p class="form-error">{{.Data.Error}}</p>{{end}}
           {{if not .Data.IsReset}}<label><span>Username</span><input name="username" autocomplete="username" required></label>{{end}}
           <label><span>Password</span><input type="password" name="password" autocomplete="new-password" minlength="8" required></label>
@@ -29,6 +31,7 @@
         <p class="kicker">Account</p>
         <h1 id="auth-title">Sign in</h1>
         <form class="stack-form" action="/login" method="post">
+          <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
           {{if .Data.Error}}<p class="form-error">{{.Data.Error}}</p>{{end}}
           <input type="hidden" name="next" value="{{.Data.ReturnPath}}">
           <label><span>Email</span><input type="email" name="email" autocomplete="email" required></label>