Upload the register step_2 photo direct to R2

[sethherr]

The register step_2 photo now uploads browser → R2 the moment it's picked, so the form posts a signed blob id instead of megabytes of multipart body and the submit no longer carries a synchronous S3 store. It lands as a PublicImage on the ActiveStorage backend from #3969, which strips EXIF and builds variants off the request.

Stacked on #3850. The bottom two commits are #3969, which needs to merge first — reviewable diff is the top four.

• The signed id rides on the b_param as params["image_signed_id"] rather than an attachment, so the PublicImage is the blob's only owner. attach_photo keeps its CarrierWave branch for the other upload paths (bikes_controller, organized/bikes_controller, the embed form).
• Two direct upload endpoints, split by how they authorize, because ActiveStorage's own accepts any content type at any size from anyone. Register::DirectUploadsController takes a b_param_token (a photo is picked before there's an account); the ActiveStorage route stays shadowed and requires a signed-in user, so the stock controller isn't reachable and later signed-in surfaces have somewhere to upload. Both inherit the content type and size checks — the presigned URL is signed against what the browser declared, so refusing there is what makes an oversized or non-image upload impossible rather than merely unused. Per-IP throttles: 10/hour for the registration endpoint, 20/minute for the authenticated one.
• PublicImage also validates an assigned file as a backstop, derived from ApplicationUploader.extensions. CSP gains the R2 endpoint, which the presigner addresses virtual-host style.
• CleanUnattachedBlobsJob reaps unattached blobs after 30 days, long enough that a partial registration confirmed weeks later still finds its photo. Stolen alert images are excluded — StolenRecord keeps superseded ones unattached on purpose. A photo that does age out is dropped without taking the registration with it.

Both R2 buckets already allow PUT from any origin with any header, so no storage config change is needed.