Add MapLibre demo and route uploads through backend.

This introduces a MapLibre GL + Three.js web demo for object placement and sharing, and changes asset upload flow to use backend upload endpoints so clients no longer receive direct MinIO URLs.

Made-with: Cursor

internal/app/service.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"strings"
 	"time"
 
@@ -36,8 +37,8 @@ type Config struct {
 }
 
 type AssetURLSigner interface {
-	SignedPutObjectURL(ctx context.Context, objectKey string, expiry time.Duration, contentType string) (string, error)
 	SignedGetObjectURL(ctx context.Context, objectKey string, expiry time.Duration) (string, error)
+	PutObject(ctx context.Context, objectKey, contentType string, body io.Reader, size int64) error
 }
 
 type Service struct {
@@ -513,11 +514,24 @@ func (s *Service) SignedUploadURL(ownerKey, assetID, contentType string) (string
 	if asset.OwnerKey != ownerKey {
 		return "", ErrForbidden
 	}
-	url, err := s.assetSigner.SignedPutObjectURL(context.Background(), asset.ObjectKey, s.config.UploadURLTTL, contentType)
-	if err != nil {
-		return "", err
+	return "/v1/assets/" + asset.ID + "/upload", nil
+}
+
+func (s *Service) UploadAsset(ownerKey, assetID, contentType string, body io.Reader, size int64) error {
+	if s.assetSigner == nil {
+		return ErrStorageNotConfigured
 	}
-	return url, nil
+	asset, err := s.store.GetAsset(assetID)
+	if err != nil {
+		return ErrAssetMiss
+	}
+	if asset.OwnerKey != ownerKey {
+		return ErrForbidden
+	}
+	if contentType == "" {
+		contentType = "application/octet-stream"
+	}
+	return s.assetSigner.PutObject(context.Background(), asset.ObjectKey, contentType, body, size)
 }
 
 func (s *Service) SignedDownloadURL(requesterKey, assetID string) (string, error) {