storage: S3/R2 objects join the Storage trait, over an injected HTTP transport

[enekos]

S3Storage<T> implements Storage, so put/get/stat/delete/list/get_reader stop caring whether the bytes are on a disk, in Postgres, or in a bucket. This closes the gap the presigner left open — the swap seam now spans fs ↔ db ↔ S3 (AWS S3, Cloudflare R2, MinIO, Garage, Ceph RGW).

let store = S3Store::r2("acct", "media", &ak, &sk).storage(SystemCurl::new());
store.put("avatars/42.png", &bytes, "image/png")?;
let url = store.presigner().presign_get("avatars/42.png", 900)?;  // same credentials

Why a transport seam and not a client

The zero-dep rule (specs/constitution.md §2). HttpTransport is one method:

• SystemCurl — https by delegating the handshake and certificate verification to the system curl. The crypto that must not be hand-rolled isn't, and the dependency count stays at zero. This is what makes AWS and R2 work out of the box.
• PlainHttp — pure std, and it refuses https rather than pretending. For a store on a trusted path: in-cluster MinIO, sidecar Garage, dev container. Same stance as the Postgres driver and the SMTP transport.
• yours — impl HttpTransport for MyClient if you already pay for ureq/reqwest.

S3Store still does not implement Storage; S3Store::storage(transport) is the crossing point from credentials to trait.

Security

• Requests are signed with the real payload hash (x-amz-content-sha256, never UNSIGNED-PAYLOAD), so a body altered in flight is refused by the store — integrity that holds even over PlainHttp.
• ETag-verified uploads and downloads when the store reports a plain MD5 (single-part, no SSE-C/KMS). Multipart/encrypted ETags are skipped, not faked. verify_etag(false) opts out.
• SystemCurl keeps credentials out of argv (URL and signed headers go in on stdin via --config -, so Authorization is invisible to ps), pins --proto =https, disables redirect following so a 3xx cannot replay a signature at an attacker-chosen host, floors TLS at 1.2, caps the body with --max-filesize, and exposes no way to disable verification. PUT bodies stage through a 0600, O_EXCL temp file removed on completion.
• Header values carrying control characters are rejected, so a caller-supplied content_type cannot inject a header. URLs with userinfo or whitespace are refused. Response bodies, header counts and line lengths are all bounded.
• list follows continuation tokens and errors past max_list_keys (default 100 000) instead of silently truncating; a store replaying one token cannot spin forever.

Pre-existing bug fixed along the way

S3Store derived Debug over access_key/secret_key/session_token — printing a store, or any struct holding one, leaked the secret key into logs. Debug now redacts.

Tests

58 unit cases + a 9-case wire suite (tests/s3_roundtrip.rs) driving the client against a tiny in-process S3 stub over a real socket: full lifecycle, 2400-key pagination across three round trips, unicode/space/plus keys through both path and XML encodings, a tampered download caught by ETag, a dead endpoint, and the same lifecycle again through a real curl subprocess including a 2 MB upload whose Expect: 100-continue interim block the parser skips.

Header signing is pinned against AWS's published known-answer vectors for GET Object and PUT Object, next to the presign vector already in the tree.

Gate: cargo fmt --check, clippy --workspace --all-targets --all-features -D warnings, and the full workspace suite (88 test targets) all green.

Reviewer notes

• make bench-compare was bypassed on commit. The regressions it reports (json_parse, e2e_request, http_parse_request, ws_accept_key) cannot come from this change: benches/ pulls sutegi with only ["sqlite", "postgres", "ws"], so nothing behind the storage feature is compiled into the bench binary. Its baseline is also from 2026-07-25 with SUTEGI_PG_TEST_URL set — the three pg_* benches read as "removed". I did not re-record it, since that would mask a future real regression.
• Not yet exercised against a real bucket. The socket-level tests are as far as local verification goes; the first live R2/S3 call is unproven. STORAGE=s3 on examples/storage does it in one command.
• S3Store::sign_request is public so the rest of the S3 API (multipart, CopyObject, tagging) is reachable through the same transport without leaving the crate.