feat(storage): serve media through backend and add local FS backend

- introduce storage.Backend with S3 and local file-system implementations
- deliver all blobs via signed GET/HEAD /api/objects/<key> (Range, Content-Type)
- stream S3 objects through the backend; remove presigned URL path
- share shared HMAC Signer between backends
- remove S3_PUBLIC_URL; rename S3_PRESIGN_TTL to OBJECT_URL_TTL
- make storage label in health dynamic; nginx proxy_buffering off for objects

backend/internal/photos/worker_test.go

@@ -6,12 +6,25 @@ import (
 	"time"
 
 	"github.com/jackc/pgx/v5/pgxpool"
+
+	"shared-album/internal/storage"
 )
 
 func TestWorkerGeneratesVariantsAndCollects(t *testing.T) {
 	pool := testPool(t)
-	ctx := context.Background()
 	svc, cl := newTestService(t, pool)
+	runWorkerFlow(t, pool, svc, cl)
+}
+
+func TestWorkerGeneratesVariantsWithFS(t *testing.T) {
+	pool := testPool(t)
+	svc, cl := newTestServiceFS(t, pool)
+	runWorkerFlow(t, pool, svc, cl)
+}
+
+func runWorkerFlow(t *testing.T, pool *pgxpool.Pool, svc *Service, cl storage.Backend) {
+	t.Helper()
+	ctx := context.Background()
 	user := createUser(t, ctx, pool)
 	album := createAlbum(t, ctx, pool, user)