feat(storage): add verified offline MinIO migration pilot

scripts/storage/sync-sdk-lock.mjs

@@ -0,0 +1,31 @@
+// Preserve the backend's exact transitive SDK graph; top-level version equality alone is insufficient.
+import { readFileSync, writeFileSync } from 'node:fs';
+const backend = JSON.parse(readFileSync(new URL('../../backend/package-lock.json', import.meta.url)));
+const manifest = JSON.parse(readFileSync(new URL('./package.json', import.meta.url)));
+const packages = { '': { name: manifest.name, version: manifest.version, dependencies: manifest.dependencies, engines: manifest.engines } };
+function resolve(from, dependency) {
+  const parts = from.split('/').filter(Boolean);
+  while (true) {
+    const candidate = [...parts, 'node_modules', dependency].join('/');
+    if (backend.packages[candidate]) return candidate;
+    if (!parts.length) return null;
+    parts.pop();
+  }
+}
+const queue = Object.keys(manifest.dependencies).map(name => resolve('', name));
+while (queue.length) {
+  const path = queue.pop();
+  if (!path) throw new Error('Missing dependency in backend lockfile');
+  if (packages[path]) continue;
+  const entry = { ...backend.packages[path] };
+  delete entry.dev;
+  packages[path] = entry;
+  for (const name of Object.keys(entry.dependencies || {})) queue.push(resolve(path, name));
+  for (const name of Object.keys(entry.optionalDependencies || {})) {
+    const resolved = resolve(path, name);
+    if (resolved) queue.push(resolved);
+  }
+}
+writeFileSync(new URL('./package-lock.json', import.meta.url), JSON.stringify({ name: manifest.name, version: manifest.version,
+  lockfileVersion: 3, requires: true, packages: Object.fromEntries(Object.entries(packages).sort(([a], [b]) => a.localeCompare(b))) }, null, 2) + '\n');
+console.log(`Copied ${Object.keys(packages).length - 1} locked backend dependencies.`);