feat(storage): replace hardcoded blog prefix with module-declared public prefixes

Refactor storage access control to use dynamic public prefixes
sourced from `getAllStoragePublicPrefixes()` instead of a hardcoded
`blog` check. Each module can now declare its own public storage
prefixes via `defineModule()` storagePublicPrefixes, making the
system extensible without modifying the core handler.

Also adds a `posts` path handler requiring admin access for private
post types, removes the deprecated `version` API endpoint and its
rate-limit exemption, and minor whitespace/comment cleanup.

src/modules/posts/config.js

@@ -82,6 +82,7 @@ function buildConfig() {
     const hasCategory = fields.some(f => f.type === 'category');
     const hasRelations = fields.some(f => f.type === 'relation');
     const label = customLabel || (key.charAt(0).toUpperCase() + key.slice(1));
+    const isPublic = process.env[`ZEN_MODULE_POSTS_TYPE_${key.toUpperCase()}_PUBLIC`] === 'true';
 
     types[key] = {
       key,
@@ -91,6 +92,7 @@ function buildConfig() {
       hasRelations,
       titleField,
       slugField,
+      public: isPublic,
     };
   }