feat(storage): serve media through backend and add local FS backend

- introduce storage.Backend with S3 and local file-system implementations
- deliver all blobs via signed GET/HEAD /api/objects/<key> (Range, Content-Type)
- stream S3 objects through the backend; remove presigned URL path
- share shared HMAC Signer between backends
- remove S3_PUBLIC_URL; rename S3_PRESIGN_TTL to OBJECT_URL_TTL
- make storage label in health dynamic; nginx proxy_buffering off for objects

backend/internal/photos/helpers_test.go

@@ -100,29 +100,47 @@ func makePNG(t *testing.T) []byte {
 
 // newTestService builds a service backed by the real dev storage. It skips when
 // S3 env is absent so unit runs stay hermetic.
-func newTestService(t *testing.T, pool *pgxpool.Pool) (*Service, *storage.Client) {
+func newTestService(t *testing.T, pool *pgxpool.Pool) (*Service, storage.Backend) {
 	t.Helper()
 	endpoint := os.Getenv("S3_ENDPOINT")
 	if endpoint == "" {
 		t.Skip("S3_ENDPOINT not set")
 	}
-	cl, err := storage.New(context.Background(), config.S3{
+	signer, err := storage.NewSigner("http://app.test", "test-secret", time.Hour)
+	if err != nil {
+		t.Skipf("signer init: %v", err)
+	}
+	cl, err := storage.NewS3(context.Background(), config.S3{
 		Endpoint:     endpoint,
 		Region:       testEnvOr("S3_REGION", "garage"),
 		AccessKey:    os.Getenv("S3_ACCESS_KEY"),
 		SecretKey:    os.Getenv("S3_SECRET_KEY"),
 		Bucket:       testEnvOr("S3_BUCKET", "galo-data"),
 		UsePathStyle: testEnvOr("S3_USE_PATH_STYLE", "true") != "false",
-		PresignTTL:   time.Hour,
-	})
+	}, signer)
 	if err != nil {
 		t.Skipf("storage init: %v", err)
 	}
 	return NewService(NewStore(pool), stubAlbums{}, cl, sse.NewHub(1)), cl
 }
 
+// newTestServiceFS builds a service backed by a temporary local file-system
+// storage backend so the full flow can run without external infrastructure.
+func newTestServiceFS(t *testing.T, pool *pgxpool.Pool) (*Service, storage.Backend) {
+	t.Helper()
+	signer, err := storage.NewSigner("http://app.test", "test-secret", time.Hour)
+	if err != nil {
+		t.Fatalf("storage init: %v", err)
+	}
+	fs, err := storage.NewFS(t.TempDir(), signer)
+	if err != nil {
+		t.Fatalf("storage init: %v", err)
+	}
+	return NewService(NewStore(pool), stubAlbums{}, fs, sse.NewHub(1)), fs
+}
+
 // cleanupPhoto removes a photo, its objects (rows and blobs) and bindings.
-func cleanupPhoto(t *testing.T, ctx context.Context, pool *pgxpool.Pool, cl *storage.Client, photoID string) {
+func cleanupPhoto(t *testing.T, ctx context.Context, pool *pgxpool.Pool, cl storage.Backend, photoID string) {
 	t.Helper()
 	rows, err := pool.Query(ctx,
 		`SELECT o.id, o.storage_key FROM photo_objects po JOIN objects o ON o.id = po.object_id