fix photo ID upload: use workers for MinIO storage + public presigned URLs

- id-upload.ts: replace broken direct minio import with workers presign/upload
- job_server.py: add minio-upload handler for API to store files via workers
- rewrite presigned URLs from internal minio:9000 to public minio.performancewest.net
- fixes: thumbnail not showing after phone upload, base64 fallback storage

scripts/workers/job_server.py

@@ -1569,6 +1569,47 @@ def handle_presign(payload: dict) -> dict:
         return {"error": str(exc)}
 
 
+def handle_minio_upload(payload: dict) -> dict:
+    """Upload a base64-encoded file to MinIO.
+
+    Payload: { key: str, data: str (base64), content_type: str, bucket: str }
+    Returns: { success: bool, key: str, size: int }
+    """
+    key = payload.get("key", "")
+    data_b64 = payload.get("data", "")
+    content_type = payload.get("content_type", "application/octet-stream")
+    bucket = payload.get("bucket", os.getenv("MINIO_BUCKET", "performancewest"))
+
+    if not key or not data_b64:
+        return {"error": "key and data required"}
+
+    try:
+        import base64
+        from io import BytesIO
+        from minio import Minio as _Minio
+
+        buf = base64.b64decode(data_b64)
+        mc = _Minio(
+            f"{os.getenv('MINIO_ENDPOINT', 'minio')}:{os.getenv('MINIO_PORT', '9000')}",
+            access_key=os.getenv("MINIO_ACCESS_KEY", ""),
+            secret_key=os.getenv("MINIO_SECRET_KEY", ""),
+            secure=os.getenv("MINIO_SECURE", "false").lower() == "true",
+        )
+        if not mc.bucket_exists(bucket):
+            mc.make_bucket(bucket)
+
+        mc.put_object(
+            bucket, key, BytesIO(buf), len(buf),
+            content_type=content_type,
+            metadata={"x-amz-meta-type": "photo-id"},
+        )
+        LOG.info("[minio-upload] Stored %s (%d bytes)", key, len(buf))
+        return {"success": True, "key": key, "size": len(buf)}
+    except Exception as exc:
+        LOG.error("[minio-upload] Failed to upload %s: %s", key, exc)
+        return {"error": str(exc)}
+
+
 def handle_esign_completed(payload: dict) -> dict:
     """Generic eSign completion callback — resume the service pipeline.
 
@@ -1786,6 +1827,7 @@ JOB_HANDLERS = {
     "purchase_client_selections": handle_purchase_client_selections,
     # eSign / MinIO helpers
     "presign": handle_presign,
+    "minio-upload": handle_minio_upload,
     "esign_completed": handle_esign_completed,
     "resume_crtc_pipeline": handle_resume_crtc_pipeline,
     # Compliance calendar renewal