feat(storage): serve media through backend and add local FS backend

- introduce storage.Backend with S3 and local file-system implementations
- deliver all blobs via signed GET/HEAD /api/objects/<key> (Range, Content-Type)
- stream S3 objects through the backend; remove presigned URL path
- share shared HMAC Signer between backends
- remove S3_PUBLIC_URL; rename S3_PRESIGN_TTL to OBJECT_URL_TTL
- make storage label in health dynamic; nginx proxy_buffering off for objects

.env.example

@@ -6,15 +6,23 @@ PG_PASSWORD=change_me
 PG_DATABASE=shared_album
 PG_SSLMODE=disable
 
-# S3 (Garage on s3.localnet)
+# S3 (Garage on s3.localnet) - internal storage, never exposed to clients
 S3_ENDPOINT=http://s3.localnet:3900
 S3_REGION=garage
 S3_ACCESS_KEY=GKchange_me
 S3_SECRET_KEY=change_me
 S3_BUCKET=galo-data
 S3_USE_PATH_STYLE=true
-S3_PUBLIC_URL=http://s3.localnet:3900/galo-data
-S3_PRESIGN_TTL=1h
+
+# Storage backend: s3 (default, S3-compatible/Garage) or fs (local filesystem).
+# Blobs are always delivered through the backend via /api/objects/<key>.
+STORAGE_BACKEND=s3
+# Required when STORAGE_BACKEND=fs: root directory for object blobs
+FS_ROOT=/var/lib/galo/objects
+# Signs object URLs; falls back to JWT_SECRET when empty
+URL_SECRET=
+# Lifetime of signed object URLs
+OBJECT_URL_TTL=1h
 
 # Auth
 JWT_SECRET=change_me_long_random