feat(storage): serve media through backend and add local FS backend

- introduce storage.Backend with S3 and local file-system implementations
- deliver all blobs via signed GET/HEAD /api/objects/<key> (Range, Content-Type)
- stream S3 objects through the backend; remove presigned URL path
- share shared HMAC Signer between backends
- remove S3_PUBLIC_URL; rename S3_PRESIGN_TTL to OBJECT_URL_TTL
- make storage label in health dynamic; nginx proxy_buffering off for objects

backend/cmd/backfill-exif/main.go

@@ -35,7 +35,7 @@ func main() {
 	}
 	defer pool.Close()
 
-	store, err := storage.New(ctx, cfg.S3)
+	store, err := storage.Open(ctx, cfg)
 	if err != nil {
 		slog.Error("storage init failed", "error", err)
 		os.Exit(1)

backend/cmd/server/main.go

@@ -55,7 +55,7 @@ func main() {
 	}
 	defer pool.Close()
 
-	store, err := storage.New(ctx, cfg.S3)
+	store, err := storage.Open(ctx, cfg)
 	if err != nil {
 		slog.Error("storage init failed", "error", err)
 		os.Exit(1)