Refactor storage to provider-agnostic band-scoped model

Replaces per-member Nextcloud credentials with a BandStorage model that
supports multiple providers. Credentials are Fernet-encrypted at rest;
worker receives audio via an internal streaming endpoint instead of
direct storage access.

- Add BandStorage DB model with partial unique index (one active per band)
- Add migrations 0007 (create band_storage) and 0008 (drop old nc columns)
- Add StorageFactory that builds the correct StorageClient from BandStorage
- Add storage router: connect/nextcloud, OAuth2 authorize/callback, list, disconnect
- Add Fernet encryption helpers in security/encryption.py
- Rewrite watcher for per-band polling via internal API config endpoint
- Update worker to stream audio from API instead of accessing storage directly
- Update frontend: new storage API in bands.ts, rewritten StorageSection,
  simplified band creation modal (no storage step)
- Add STORAGE_ENCRYPTION_KEY to all docker-compose files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -50,6 +50,7 @@ services:
       REDIS_URL: redis://redis:6379/0
       SECRET_KEY: ${SECRET_KEY:-replace_me_with_32_byte_hex_default}
       INTERNAL_SECRET: ${INTERNAL_SECRET:-replace_me_with_32_byte_hex_default}
+      STORAGE_ENCRYPTION_KEY: ${STORAGE_ENCRYPTION_KEY:-5vaaZQs4J7CFYZ7fqee37HgIt4xNxKHHX6OWd29Yh5E=}
       DOMAIN: ${DOMAIN:-localhost}
     networks:
       - rh_net
@@ -78,9 +79,8 @@ services:
     environment:
       DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-rh_user}:${POSTGRES_PASSWORD:-default_secure_password}@db:5432/${POSTGRES_DB:-rehearsalhub}
       REDIS_URL: redis://redis:6379/0
-      NEXTCLOUD_URL: ${NEXTCLOUD_URL:-https://cloud.example.com}
-      NEXTCLOUD_USER: ${NEXTCLOUD_USER:-rh_service}
-      NEXTCLOUD_PASS: ${NEXTCLOUD_PASS:-default_password}
+      API_URL: http://api:8000
+      INTERNAL_SECRET: ${INTERNAL_SECRET:-replace_me_with_32_byte_hex_default}
       ANALYSIS_VERSION: "1.0.0"
     volumes:
       - audio_tmp:/tmp/audio
@@ -94,6 +94,8 @@ services:
       api:
         condition: service_started
     restart: unless-stopped
+    deploy:
+      replicas: ${WORKER_REPLICAS:-2}
 
   nc-watcher:
     build: