object storage + full permission system + testing

Object storage now works fully, with the permission system. It still
needs additional external endpoints for updating and deleting objects
from the API, but it is otherwise complete. Further tasks include
writing an S3 adapter.

server/middleware/require-user.global.ts

@@ -1,4 +1,4 @@
-const whitelistedPrefixes = ["/signin", "/register"];
+const whitelistedPrefixes = ["/signin", "/register", "/api"];
 
 export default defineNuxtRouteMiddleware(async (to, from) => {
   if (import.meta.server) return;