Add R2 image display in homepage with CDN support

CLAUDE.md

@@ -98,6 +98,10 @@ Backend получает запросы с prefix `/api/` (Caddy использ
 ### Конфигурация
 
 - `backend/src/GBSite.Api/appsettings.Local.json` — connection string к dev_db (gitignored)
+- `.NET User Secrets` — R2 credentials и другие секреты (хранятся вне репо)
+  - Управление: `dotnet user-secrets set "R2:AccountId" "value"` (из папки `backend/src/GBSite.Api`)
+  - Просмотр: `dotnet user-secrets list`
+  - User secrets имеют приоритет выше appsettings*.json
 - `frontend/.env.local` — `LOCAL_API_URL` и `INTERNAL_API_URL` для локального проксирования
 - `deploy/docker-compose.local.yml` — Docker backend с `host.docker.internal:5433`
 
@@ -175,7 +179,7 @@ Locally via `appsettings.Local.json` with SSH tunnel (`localhost:5433`).
 - **CDN domain:** https://cdn.goodbrick.com.ua
 - **Bucket:** goodbrick
 - **Frontend:** `NEXT_PUBLIC_CDN_URL` env var, `cdnUrl()` helper in `src/lib/cdn.ts`
-- **Backend:** `R2__*` env vars, `R2StorageService` for uploads
+- **Backend:** `R2__*` env vars (server), .NET User Secrets (local), `R2StorageService` for uploads
 - **Upload endpoint:** `POST /api/upload` — multipart/form-data, max 10MB, images only (jpeg/png/webp/avif)
 
 ### Folder Convention
@@ -185,7 +189,7 @@ Locally via `appsettings.Local.json` with SSH tunnel (`localhost:5433`).
 
 ## Key Rules
 
-- Never commit `.env` files or secrets — credentials are in docker-compose env vars on server
+- Never commit `.env` files or secrets — on server: docker-compose env vars, locally: .NET User Secrets
 - Frontend standalone output (`output: "standalone"` in next.config.ts) — required for Docker
 - Backend listens on port 5000 (`ASPNETCORE_URLS=http://+:5000`)
 - All containers must be in `app-network` (external Docker network)