fix(backend): use public MinIO origin for browser uploads

Backend/routes/recordings.ts

@@ -6,7 +6,13 @@ import { db } from '../db/client';
 import { recordings } from '../db/schema';
 import { requireDeviceAuth } from '../middleware/device-auth';
 import { writeAuditLog } from '../services/audit';
-import { ensureMinioBucket, minioBucket, minioClient, minioPresignedExpirySeconds } from '../utils/minio';
+import {
+  ensureMinioBucket,
+  minioBucket,
+  minioClient,
+  minioPresignClient,
+  minioPresignedExpirySeconds,
+} from '../utils/minio';
 
 const router = Router();
 
@@ -227,7 +233,7 @@ router.get('/:recordingId/download-url', requireDeviceAuth, async (req, res) =>
     throw error;
   }
 
-  const downloadUrl = await minioClient.presignedGetObject(
+  const downloadUrl = await minioPresignClient.presignedGetObject(
     recording.bucket,
     recording.objectKey,
     minioPresignedExpirySeconds,