feat(storage): serve media through backend and add local FS backend

- introduce storage.Backend with S3 and local file-system implementations
- deliver all blobs via signed GET/HEAD /api/objects/<key> (Range, Content-Type)
- stream S3 objects through the backend; remove presigned URL path
- share shared HMAC Signer between backends
- remove S3_PUBLIC_URL; rename S3_PRESIGN_TTL to OBJECT_URL_TTL
- make storage label in health dynamic; nginx proxy_buffering off for objects

backend/internal/app/health_test.go

@@ -0,0 +1,71 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"shared-album/internal/config"
+	"shared-album/internal/storage"
+)
+
+func mustSigner(t *testing.T) *storage.Signer {
+	t.Helper()
+	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour)
+	if err != nil {
+		t.Fatalf("signer: %v", err)
+	}
+	return signer
+}
+
+func lazyPool(t *testing.T) *pgxpool.Pool {
+	t.Helper()
+	pool, err := pgxpool.New(context.Background(), "postgres://u:p@127.0.0.1:1/x?sslmode=disable")
+	if err != nil {
+		t.Fatalf("pool: %v", err)
+	}
+	t.Cleanup(pool.Close)
+	return pool
+}
+
+func TestHealthStorageLabel(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	fs, err := storage.NewFS(t.TempDir(), mustSigner(t))
+	if err != nil {
+		t.Fatalf("fs: %v", err)
+	}
+	srv := &Server{cfg: &config.Config{}, pool: lazyPool(t), storage: fs}
+
+	call := func() map[string]any {
+		rec := httptest.NewRecorder()
+		c, _ := gin.CreateTestContext(rec)
+		c.Request = httptest.NewRequest(http.MethodGet, "/api/health", nil)
+		srv.health(c)
+		var body map[string]any
+		if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+			t.Fatalf("decode: %v", err)
+		}
+		return body
+	}
+
+	srv.cfg.Storage.Backend = "fs"
+	if body := call(); body["fs"] != "ok" {
+		t.Fatalf("expected fs label ok, got %v", body)
+	}
+
+	srv.cfg.Storage.Backend = "s3"
+	if body := call(); body["s3"] != "ok" {
+		t.Fatalf("expected s3 label ok, got %v", body)
+	}
+
+	srv.cfg.Storage.Backend = ""
+	if body := call(); body["s3"] != "ok" {
+		t.Fatalf("expected default s3 label, got %v", body)
+	}
+}