Add S3/MinIO storage, nelmio security and CSP config

- Flysystem S3 adapter configured for MinIO
- Vich uploader switched to Flysystem S3 storage
- Liip imagine loader/resolver on S3
- S3 client service with path style endpoint for MinIO
- Nelmio security: CSP, clickjacking, permissions policy, external redirects
- CSP dev: allow Vite HMR (localhost:5173)
- CSP prod: nonce scripts, restricted form-action and connect-src
- composer: flysystem-bundle, flysystem-aws-s3-v3, nelmio/security-bundle

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

composer.json

@@ -12,7 +12,10 @@
         "doctrine/orm": "^3.6",
         "dompdf/dompdf": "*",
         "endroid/qr-code-bundle": "*",
+        "league/flysystem-aws-s3-v3": "^3.32",
+        "league/flysystem-bundle": "^3.6",
         "liip/imagine-bundle": "^2.17",
+        "nelmio/security-bundle": "^3.9",
         "phpdocumentor/reflection-docblock": "^6.0",
         "phpstan/phpdoc-parser": "^2.3",
         "symfony/asset": "8.0.*",