add-production-storage-and-datalisted

Two failures with the same root: state that lives in the process or next to it. ## Diagnose Start with evidence from the code itself. In the repository: ```bash npx @trustycap/cli productionize --json ``` The scanner reads the route handlers with the TypeScript compiler API and classifies each against the published production standard (`GET https://api.trustycap.com/v1/production/requirements`): file and line, AST evidence, a classification (`CONFIRMED_FAIL`, `PROBABLE_GAP`, `UNKNOWN`, `PASS`), the provider-neutral requirement, the implementations that satisfy it, and the exact commands. `UNKNOWN` is not a failure; read the code it points at rather than installing over it. A requirement the project already satisfies another way is declared in `trustycap.production.json`. - **Storage.** Are uploads written to a local path? Does any credential reach the browser? A key that reaches the browser has left the building; the only safe shape is a short-lived signed link minted server-side for exactly one object. - **Data.** Are records in memory, a module-level array, or a file beside the code? They are gone on the first restart and disagree on the second instance. Does any query forget its tenant? That is not a bug testing finds; it is a bug two customers find at once. ## Fit, and not for **Storage is not for** a CDN for public assets, or an application whose files are few and small enough to live in its database. **Data is not for** analytical workloads over very large tables