fix: serve storage files directly via Caddy route (bypass symlink 404)

FrankenPHP/Caddy does not reliably follow the public/storage symlink
when serving static files, causing 404 on all media URLs (/storage/…).
Add CADDY_SERVER_EXTRA_DIRECTIVES with an explicit handle_path block
that maps /storage/* directly to /app/storage/app/public, avoiding the
symlink entirely.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker/entrypoint.sh

@@ -37,6 +37,11 @@ fi
 # Storage symlink (idempotent)
 php artisan storage:link --no-interaction 2>/dev/null || true
 
+# FrankenPHP/Caddy does not follow the public/storage→storage/app/public symlink
+# reliably. Add an explicit Caddy route that serves /storage/* directly from the
+# real directory, bypassing symlink resolution entirely.
+export CADDY_SERVER_EXTRA_DIRECTIVES='handle_path /storage/* { root * /app/storage/app/public; file_server }'
+
 # Background scheduler — fires every minute. Drives backup:tenants and other cron jobs.
 # Skipped if RUN_SCHEDULER=false (e.g., when running multiple replicas).
 if [ "${RUN_SCHEDULER:-true}" = "true" ]; then