Phase 1: chunk store, tile rendering pipeline, and Leaflet viewer

api: WS gateway with token auth (Postgres-backed servers table, seeded via
`bun run seed`), column-granularity chunk store (hand-written SQL
migrations, no drizzle-kit CLI — its config loader needs esbuild, which
doesn't install cleanly here), dirty-chunk Redis stream producer with
per-flush dedup, and a tile-serving route.

worker: consumes the dirty-chunk stream via a proper consumer group,
rasterizes each chunk's columns into a single-resolution top-down PNG
(static pre-Flattening block-id palette), uploads to MinIO, and upserts
the tile pointer.

frontend: barebones Leaflet 2D viewer (CRS.Simple, one native zoom level)
wired to /api/servers and /api/tiles.

Object storage: tiles live in a dedicated `mcmapper-tiles` bucket on the
existing shared MinIO instance (devstack-minio on octo-winsrv) instead of
a per-stack container, via a scoped access key limited to that one bucket
— see README's "Object storage" section. MINIO_SECRET_KEY is real and is
deliberately not committed; docker-compose layers an untracked .env over
.env.example for it.

Full pipeline verified end-to-end against live containers: WS auth ->
Postgres upsert -> deduped Redis dirty-chunk event -> worker rasterize ->
MinIO upload -> tile fetch through the api route, including from the
actual mod-side WS client (see MCMapper-Mod's matching commit).

api/.env.example

@@ -1,7 +1,21 @@
 PORT=3000
 DATABASE_URL=postgres://mcmapper:mcmapper@postgres:5432/mcmapper
 REDIS_URL=redis://redis:6379
-MINIO_ENDPOINT=minio
-MINIO_PORT=9000
+
+# Tiles/meshes live in a dedicated `mcmapper-tiles` bucket on a shared MinIO instance rather
+# than a per-stack container — see README.md's "Object storage" section for how the bucket and
+# this scoped access key (read/write on mcmapper-tiles only, nothing else) were provisioned.
+# 192.168.0.3:28205 is that instance's LAN address; swap for the public gateway
+# (MINIO_ENDPOINT=s3.octoturge.com, MINIO_PORT=443, MINIO_USE_SSL=true) if this stack isn't on
+# the same LAN. MINIO_SECRET_KEY is real and must NOT be committed — set it in an untracked
+# `.env` next to this file (docker-compose layers it on top, see docker-compose.yml).
+MINIO_ENDPOINT=192.168.0.3
+MINIO_PORT=28205
+MINIO_USE_SSL=false
 MINIO_ACCESS_KEY=mcmapper
-MINIO_SECRET_KEY=mcmapper-dev-only
+MINIO_SECRET_KEY=changeme-set-in-untracked-env
+
+# Only read by `bun run seed` (see scripts/seed-server.ts) — Phase 6 replaces this with a real
+# admin registration API. Point the mod's MapperConfig#serverToken at the same value.
+MCMAPPER_SEED_SERVER_NAME=dev-server
+MCMAPPER_SEED_SERVER_TOKEN=changeme