feat(storage): serve media through backend and add local FS backend

- introduce storage.Backend with S3 and local file-system implementations
- deliver all blobs via signed GET/HEAD /api/objects/<key> (Range, Content-Type)
- stream S3 objects through the backend; remove presigned URL path
- share shared HMAC Signer between backends
- remove S3_PUBLIC_URL; rename S3_PRESIGN_TTL to OBJECT_URL_TTL
- make storage label in health dynamic; nginx proxy_buffering off for objects

backend/internal/config/config_test.go

@@ -0,0 +1,70 @@
+package config
+
+import (
+	"testing"
+	"time"
+)
+
+func setRequiredEnv(t *testing.T) {
+	t.Helper()
+	t.Setenv("JWT_SECRET", "test-secret")
+	t.Setenv("PG_PASSWORD", "test-pass")
+}
+
+func TestLoadStorageBackend(t *testing.T) {
+	t.Run("defaults to s3", func(t *testing.T) {
+		setRequiredEnv(t)
+		t.Setenv("STORAGE_BACKEND", "")
+		cfg, err := Load()
+		if err != nil {
+			t.Fatalf("load: %v", err)
+		}
+		if cfg.Storage.Backend != "s3" {
+			t.Fatalf("backend = %q, want s3", cfg.Storage.Backend)
+		}
+	})
+
+	t.Run("fs with root", func(t *testing.T) {
+		setRequiredEnv(t)
+		t.Setenv("STORAGE_BACKEND", "fs")
+		t.Setenv("FS_ROOT", "/var/lib/galo/objects")
+		cfg, err := Load()
+		if err != nil {
+			t.Fatalf("load: %v", err)
+		}
+		if cfg.Storage.Backend != "fs" || cfg.Storage.FSRoot != "/var/lib/galo/objects" {
+			t.Fatalf("storage = %+v", cfg.Storage)
+		}
+	})
+
+	t.Run("fs without root", func(t *testing.T) {
+		setRequiredEnv(t)
+		t.Setenv("STORAGE_BACKEND", "fs")
+		t.Setenv("FS_ROOT", "")
+		t.Setenv("URL_SECRET", "")
+		if _, err := Load(); err == nil {
+			t.Fatal("expected error for fs without FS_ROOT")
+		}
+	})
+
+	t.Run("invalid backend", func(t *testing.T) {
+		setRequiredEnv(t)
+		t.Setenv("STORAGE_BACKEND", "gcs")
+		if _, err := Load(); err == nil {
+			t.Fatal("expected error for invalid backend")
+		}
+	})
+
+	t.Run("object url ttl", func(t *testing.T) {
+		setRequiredEnv(t)
+		t.Setenv("STORAGE_BACKEND", "")
+		t.Setenv("OBJECT_URL_TTL", "30m")
+		cfg, err := Load()
+		if err != nil {
+			t.Fatalf("load: %v", err)
+		}
+		if cfg.Storage.URLTTL != 30*time.Minute {
+			t.Fatalf("URLTTL = %v, want 30m", cfg.Storage.URLTTL)
+		}
+	})
+}