feat(storage): serve media through backend and add local FS backend

- introduce storage.Backend with S3 and local file-system implementations
- deliver all blobs via signed GET/HEAD /api/objects/<key> (Range, Content-Type)
- stream S3 objects through the backend; remove presigned URL path
- share shared HMAC Signer between backends
- remove S3_PUBLIC_URL; rename S3_PRESIGN_TTL to OBJECT_URL_TTL
- make storage label in health dynamic; nginx proxy_buffering off for objects

deploy/nginx-sse.conf

@@ -21,6 +21,14 @@ server {
         chunked_transfer_encoding on;
     }
 
+    location /api/objects/ {
+        proxy_pass http://shared_album;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_buffering off;              # стриминг объектов без буферизации
+        proxy_cache off;
+    }
+
     location / {
         proxy_pass http://shared_album;
         proxy_http_version 1.1;