feat(media): pluggable storage backend + S3 implementation

[ilyaseverin]

Summary

Adds a media.Backend interface and an S3Backend implementation so goclaw can run on ephemeral hosts without losing session media on restart. The existing filesystem behaviour is preserved exactly — GOCLAW_MEDIA_BACKEND defaults to fs and every current call site keeps working unchanged.

Three commits, intentionally separable for review:

1. refactor(media): introduce Backend interface, keep Store as façade — splits internal/media/store.go into backend.go (interface), fs_backend.go (the historical implementation, unchanged), and a thin store.go façade. No behaviour change.
2. feat(media): add S3Backend + env-driven factory — S3Backend persists objects under {prefix}/{sessionHash}/{id}.{ext} with a manifest sidecar at {prefix}/_manifests/{id} so LocalPath/Open resolve a bare ID in two GETs. Credentials come from the default SDK chain only (IAM role / env), no static-key field. LocalPath lazily caches into os.TempDir()/goclaw-media-cache with atomic rename. Delete paginates the session prefix and DeleteObjects in batches of 1000.
3. feat(media): wire env-driven backend selection + FSBackend tests — cmd/gateway_managed.go now goes through media.LoadConfigFromEnv / NewStoreFromConfig. Adds round-trip / mime-ext / not-found tests for the FS backend.

Why

Today media.Store is concrete and FS-only. Deployments on Fargate / K8s without persistent volumes / EC2 ASGs that rotate instances drop their session media on every restart. The workaround — pointing baseDir at EFS/EBS — is heavier than handing the same problem to S3 with a 7-day lifecycle rule.

Secondary win: the concrete *media.Store type made it impossible to substitute a fake in tests; new code can now depend on media.Backend directly.

Env vars

Var	Default	Purpose
GOCLAW_MEDIA_BACKEND	fs	fs or s3
GOCLAW_MEDIA_BASEDIR	{workspace}/.media	FS only
GOCLAW_MEDIA_S3_BUCKET	—	required when backend=s3
GOCLAW_MEDIA_S3_PREFIX	empty	key prefix inside the bucket
GOCLAW_MEDIA_S3_REGION	us-east-1
GOCLAW_MEDIA_S3_ENDPOINT	—	for MinIO / R2 / DO Spaces
GOCLAW_MEDIA_S3_CACHE_DIR	$TMPDIR/goclaw-media-cache	local read cache

IAM permissions needed for the bucket: s3:PutObject, s3:GetObject, s3:DeleteObject, s3:ListBucket, s3:DeleteObjects.

Test plan

• FSBackend unit tests (round-trip, mime ext precedence, ErrNotFound).
• S3Backend integration: not in the test suite — gated on GOCLAW_TEST_S3_BUCKET would be the natural follow-up; happy to add in this PR if you'd like.
• Build + existing tests on CI.
• Smoke on my fork's staging once merged downstream (injectinglabs/goclaw).

Out of scope

• Workspace-as-S3 (covers user-generated files under workspace/generated/...). That requires a separate workspace abstraction and is orthogonal to session media.
• Signed download URLs for generated documents — already covered upstream via POST /v1/files/sign.

Open questions

1. Naming: Backend vs Storage vs Driver? I went with Backend to match internal/backup. Happy to rename.
2. Should Save take an io.Reader instead of srcPath? Current callers all have a local file, so srcPath keeps the FS backend's rename-fast-path; reader-based API would force FS to write a tempfile.
3. Add a gated s3_backend_test.go in this PR, or as a follow-up?

🤖 Generated with Claude Code

[mrgoonie]

Summary: Deferred in cron-safe maintenance pass because this PR is still a draft and exceeds the bounded review budget.

Decision: deferred / needs full review when ready

Evidence:

• PR is marked draft, so it is not merge-ready.
• Scope is non-trivial: 7 files, +706/-88 lines, including a new S3 media backend and env-driven backend selection.
• GitHub reports no checks for the current head.

Next step: mark ready for review after CI is available and decide whether S3 integration tests should be included in this PR or follow-up. Once it is ready, it needs a full storage/security review covering bucket key layout, cache behavior, delete semantics, env config, and regression tests.