feat: per-round advancement selection, email preview, Docker/auth fixes

- Bulk notification dialog: per-round checkboxes (default none selected),
  selected count badge, "Preview Email" button with rendered iframe
- Backend: roundIds filter on sendBulkPassedNotifications, new
  previewAdvancementEmail query
- Docker: add external MinIO network so app container can reach MinIO
- File router: try/catch on getPresignedUrl with descriptive error
- Auth: custom NextAuth logger suppresses CredentialsSignin stack traces

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/server/routers/file.ts

@@ -111,9 +111,18 @@ export const fileRouter = router({
         }
       }
 
-      const url = await getPresignedUrl(input.bucket, input.objectKey, 'GET', 900,
-        input.forDownload ? { downloadFileName: input.fileName || input.objectKey.split('/').pop() || 'download' } : undefined
-      ) // 15 min
+      let url: string
+      try {
+        url = await getPresignedUrl(input.bucket, input.objectKey, 'GET', 900,
+          input.forDownload ? { downloadFileName: input.fileName || input.objectKey.split('/').pop() || 'download' } : undefined
+        ) // 15 min
+      } catch (err) {
+        console.error('[file] getPresignedUrl failed:', input.objectKey, err instanceof Error ? err.message : err)
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: `File not available in storage: ${err instanceof Error ? err.message : 'unknown error'}`,
+        })
+      }
 
       // Log file access
       await logAudit({