feat: harden production data and backups

compose.production.yaml

@@ -86,6 +86,7 @@ services:
       OFFICIAL_RECORDS_REGION: ${OFFICIAL_RECORDS_REGION:-RU}
       OFFICIAL_RECORDS_CATEGORY: ${OFFICIAL_RECORDS_CATEGORY:-records}
       OFFICIAL_IMPORT_REQUIRED: ${OFFICIAL_IMPORT_REQUIRED:-false}
+      SEED_DEMO_DATA: "false"
       IMPORT_INTERVAL_SECONDS: ${IMPORT_INTERVAL_SECONDS:-3600}
       RATE_LIMIT_SECRET: ${RATE_LIMIT_SECRET:?Set RATE_LIMIT_SECRET}
       LOG_LEVEL: ${LOG_LEVEL:-INFO}
@@ -122,6 +123,14 @@ services:
       resources:
         limits: {cpus: "0.75", memory: 512M}
 
+  storage-tool:
+    image: alpine:3.22
+    profiles: [tools]
+    volumes:
+      - minio_data:/data
+      - ${BACKUP_DIRECTORY:-./backups}:/backup
+    security_opt: [no-new-privileges:true]
+
 networks:
   edge:
   backend: