fix(gateway): regression-test removed anonymous /thumbnails proxy

[SlavaKuntsov]

Closes #45

Summary

The vulnerability from #45 (private video thumbnails publicly served) was already fixed in #43: the anonymous /thumbnails/* MinIO proxy was removed from the gateway, the MinIO bucket is fully private, and metadata now returns presigned absolute thumbnail_url values (MINIO_PUBLIC_ENDPOINT).

This PR locks that in with a regression test:

• services/gateway/cmd/server/main.go — router construction extracted from main() into a testable newRouter(cfg routerConfig) (mechanical refactor, no logic change).
• services/gateway/cmd/server/main_test.go (new) — TestNoAnonymousThumbnailsProxy: GET /thumbnails/vid-1/thumb.jpg and GET /thumbnails/ must return 404 (no route — the anonymous proxy must never come back).

Acceptance criteria

• Thumbnail of a private video is not reachable without a token: gateway /thumbnails/* → 404; direct MinIO without a signature → 403 (fully private bucket, presigned URLs from P0 infra: restrict MinIO anonymous policy and close 9000/8081 exposure #43).

Verification

• go test ./... (gateway) — pass, including the new regression test
• make lint-go — 0 issues
• make test-go — all 8 packages ok
• make e2e — not run (requires the full Docker stack); the bucket-privacy guarantee is covered by deploy config from P0 infra: restrict MinIO anonymous policy and close 9000/8081 exposure #43

Review

• Independent review iteration 1: no blocking findings (details in the issue comment).