fix: serve uploaded images via API route (public/ is read-only in production)

Next.js bakes public/ at build time — dynamically uploaded files were
never served in Docker standalone mode. Store uploads in data/uploads/
and serve via /api/uploads/ with a rewrite for backward compatibility.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

memento-note/app/api/upload/route.ts

@@ -46,8 +46,8 @@ export async function POST(request: NextRequest) {
     }
     const filename = `${randomUUID()}${ext}`
     
-    // Ensure directory exists
-    const uploadDir = path.join(process.cwd(), 'public/uploads/notes')
+    // Ensure directory exists (data/uploads is outside public/, served via API route)
+    const uploadDir = path.join(process.cwd(), 'data/uploads/notes')
     await mkdir(uploadDir, { recursive: true })
     
     const filePath = path.join(uploadDir, filename)