fix(web-player): send presigned uploads to a reachable S3 endpoint

The PUT was always sent to 127.0.0.1, which is nothing inside the container, so
uploads failed whenever the web player did not run on the same host as
SeaweedFS. Take an optional S3_UPLOAD_ENDPOINT instead (the compose stacks
point it at seaweedfs:8333) and fall back to the host in the presigned URL. The
signed Host header is preserved either way, so the signature still matches.

web-player/.env.example

@@ -1,3 +1,6 @@
+# Local configuration for `npm run dev`. deploy/zitadel/provision.ps1 fills in
+# the Zitadel values; in Docker the same variables come from deploy/compose.yml.
+
 # Zitadel OIDC (server-side auth)
 ZITADEL_ISSUER=http://host.docker.internal:8080
 ZITADEL_CLIENT_ID=your-web-app-client-id
@@ -10,6 +13,9 @@ AUTH_POST_LOGOUT_URI=http://localhost:5173/
 # Secret used to derive the session cookie encryption key (any long random string)
 SESSION_SECRET=change-me-to-a-long-random-string
 
+# Backend API base URL
+API_BASE_URL=http://localhost:5111
+
 # Optional session tuning (defaults shown)
 # OIDC_SCOPE=openid profile email offline_access
 # SESSION_TTL_SECONDS=604800
@@ -19,5 +25,7 @@ SESSION_SECRET=change-me-to-a-long-random-string
 # Dev already allows a plain-HTTP issuer. Set this only to allow it in a production build (never with a public issuer).
 # AUTH_ALLOW_INSECURE_HTTP=true
 
-# Backend API base URL (used from later parts)
-API_BASE_URL=http://localhost:5111
+# Where to send presigned S3 PUTs when the public S3 host is not reachable from
+# the server (in Docker: http://seaweedfs:8333). The signed Host header is kept
+# either way. Defaults to the host in the presigned URL.
+# S3_UPLOAD_ENDPOINT=http://localhost:8333