Bind-mount backend/uploads in dev; path helpers with traversal guards and Jest coverage for StorageService.
Thin API bootstrap with config module and nullcart-style health route for Docker checks.