feat(storage): serve media through backend and add local FS backend

- introduce storage.Backend with S3 and local file-system implementations
- deliver all blobs via signed GET/HEAD /api/objects/<key> (Range, Content-Type)
- stream S3 objects through the backend; remove presigned URL path
- share shared HMAC Signer between backends
- remove S3_PUBLIC_URL; rename S3_PRESIGN_TTL to OBJECT_URL_TTL
- make storage label in health dynamic; nginx proxy_buffering off for objects

backend/internal/app/objects_test.go

@@ -0,0 +1,110 @@
+package app
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"shared-album/internal/config"
+	"shared-album/internal/sse"
+	"shared-album/internal/storage"
+)
+
+func newTestServerWithFS(t *testing.T) (*storage.FS, *gin.Engine) {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	signer, err := storage.NewSigner("http://app.test", "secret", time.Hour)
+	if err != nil {
+		t.Fatalf("signer: %v", err)
+	}
+	fs, err := storage.NewFS(t.TempDir(), signer)
+	if err != nil {
+		t.Fatalf("new fs: %v", err)
+	}
+	srv := New(&config.Config{}, nil, fs, sse.NewHub(1))
+	return fs, srv.Router()
+}
+
+func TestServeObjectRoute(t *testing.T) {
+	ctx := context.Background()
+	fs, r := newTestServerWithFS(t)
+	key := "objects/abc/original.jpg"
+	if err := fs.Put(ctx, key, strings.NewReader("0123456789"), 10, "image/jpeg"); err != nil {
+		t.Fatalf("put: %v", err)
+	}
+	raw, err := fs.URL(ctx, key)
+	if err != nil {
+		t.Fatalf("url: %v", err)
+	}
+	u, err := url.Parse(raw)
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+
+	do := func(target string, rangeHeader string) *httptest.ResponseRecorder {
+		req := httptest.NewRequest(http.MethodGet, target, nil)
+		if rangeHeader != "" {
+			req.Header.Set("Range", rangeHeader)
+		}
+		rec := httptest.NewRecorder()
+		r.ServeHTTP(rec, req)
+		return rec
+	}
+
+	t.Run("valid", func(t *testing.T) {
+		rec := do(u.Path+"?"+u.RawQuery, "")
+		if rec.Code != http.StatusOK {
+			t.Fatalf("status = %d, want 200", rec.Code)
+		}
+		if rec.Body.String() != "0123456789" {
+			t.Fatalf("body = %q", rec.Body.String())
+		}
+	})
+
+	t.Run("range", func(t *testing.T) {
+		rec := do(u.Path+"?"+u.RawQuery, "bytes=2-5")
+		if rec.Code != http.StatusPartialContent {
+			t.Fatalf("status = %d, want 206", rec.Code)
+		}
+		if rec.Body.String() != "2345" {
+			t.Fatalf("body = %q, want 2345", rec.Body.String())
+		}
+	})
+
+	t.Run("expired", func(t *testing.T) {
+		q := u.Query()
+		q.Set("e", strconv.FormatInt(time.Now().Add(-time.Minute).Unix(), 10))
+		rec := do(u.Path+"?"+q.Encode(), "")
+		if rec.Code != http.StatusForbidden {
+			t.Fatalf("status = %d, want 403", rec.Code)
+		}
+	})
+
+	t.Run("forged", func(t *testing.T) {
+		q := u.Query()
+		q.Set("s", "deadbeef")
+		rec := do(u.Path+"?"+q.Encode(), "")
+		if rec.Code != http.StatusForbidden {
+			t.Fatalf("status = %d, want 403", rec.Code)
+		}
+	})
+
+	t.Run("missing", func(t *testing.T) {
+		raw, err := fs.URL(ctx, "objects/def/original.jpg")
+		if err != nil {
+			t.Fatalf("url: %v", err)
+		}
+		mu, _ := url.Parse(raw)
+		rec := do(mu.Path+"?"+mu.RawQuery, "")
+		if rec.Code != http.StatusNotFound {
+			t.Fatalf("status = %d, want 404", rec.Code)
+		}
+	})
+}