feat: per-round advancement selection, email preview, Docker/auth fixes

- Bulk notification dialog: per-round checkboxes (default none selected),
  selected count badge, "Preview Email" button with rendered iframe
- Backend: roundIds filter on sendBulkPassedNotifications, new
  previewAdvancementEmail query
- Docker: add external MinIO network so app container can reach MinIO
- File router: try/catch on getPresignedUrl with descriptive error
- Auth: custom NextAuth logger suppresses CredentialsSignin stack traces

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/lib/auth.ts

@@ -15,6 +15,16 @@ const LOCKOUT_DURATION_MS = 15 * 60 * 1000 // 15 minutes
 
 export const { handlers, auth, signIn, signOut } = NextAuth({
   ...authConfig,
+  logger: {
+    error(error) {
+      // CredentialsSignin is expected (wrong password, bots) — already logged to AuditLog with detail
+      if (error?.name === 'CredentialsSignin') return
+      console.error('[auth][error]', error)
+    },
+    warn(code) {
+      console.warn('[auth][warn]', code)
+    },
+  },
   adapter: {
     ...PrismaAdapter(prisma),
     async useVerificationToken({ identifier, token }: { identifier: string; token: string }) {