fix: use local storage/ in dev, create upload dirs, gitignore uploads

app/bootstrap.php

@@ -10,7 +10,12 @@ define('APP_ROOT', __DIR__);
 // Storage directory for uploaded files — intentionally outside the webroot
 // so no uploaded content is ever directly web-accessible (items #3 & #4).
 // Files are served through MediaController which validates paths and MIME types.
-define('STORAGE_ROOT', '/var/www/posterg/storage');
+// In dev (cli-server) use the local storage/ directory; in production use the
+// absolute path outside the webroot.
+define('STORAGE_ROOT', php_sapi_name() === 'cli-server'
+    ? __DIR__ . '/storage'
+    : '/var/www/posterg/storage'
+);
 
 // Error reporting
 if (php_sapi_name() === 'cli-server') {