feat: add host-provided module object storage

`manifest.storage.buckets` has existed since manifest version 1 and meant
nothing — discovery validated it and no code read it. This turns it into a
real capability, which is what stands between Announcements and the module
system: that product currently fetches a hardcoded LAN S3 endpoint, parses
ListObjectsV2 XML by hand, and hands the browser direct object URLs.

- A module declares a logical bucket and receives a scoped facade at
  `context.storage` — list, head, get, put, delete. The contract names no
  provider: no endpoint, region, credential, or physical bucket is reachable
  from it, which is what lets the same module run under a future standalone
  host over its own or a shared S3-compatible service.
- Core's first provider speaks S3 through the AWS SDK. SeaweedFS is the
  deployment target (ADR 0004), never an API name. Probing the pinned image
  found `CreateBucket` reporting `BucketAlreadyExists` rather than AWS's
  `BucketAlreadyOwnedByYou`; treating only the AWS spelling as success would
  have failed every second boot. A live test pins it.
- Logical → physical mapping is deterministic and collision-safe: an
  installation prefix, the module and bucket ids joined by `--` (which cannot
  occur inside either identifier, so `a-b`+`c` and `a`+`b-c` cannot collide),
  and a digest over the full untruncated identity. Two modules declaring
  `assets` always get separate namespaces; neither can see the physical name.
- Declaring a bucket is now a requirement: with no provider configured the
  module is `blocked · storage_unavailable` through ADR 0028's existing
  resolver, propagating to required dependents. An installation with no object
  storage stays a complete deployment.
- Binding availability is not provider health. Eligibility asks whether
  storage is configured, never whether it answered; bucket creation is lazy on
  first use so a storage outage cannot stop the platform booting; a running
  module whose store blinks stays running and retries. Nothing deletes a
  bucket.
- Credentials are deployment-supplied, never persisted, never routed through
  module configuration, and never visible to modules, module UI, diagnostics,
  or API responses. Provider errors translate to a closed code set carrying no
  endpoint, bucket, request id, or XML.
- Retires ADR 0029's transitional `bucket` configuration key. No manifest
  version change. The template declares no bucket, so it still runs without S3.

See ADR 0030.

Co-Authored-By: Claude Opus 5 <[email protected]>

apps/api/tests/module-http-routes.test.ts

@@ -28,6 +28,7 @@ import {
 } from "../src/module-http-routes.js";
 import { emptyModuleLifecycle } from "./support/in-memory-module-lifecycle.js";
 import { emptyModuleConfiguration } from "./support/in-memory-module-configuration.js";
+import { emptyModuleStorage } from "./support/in-memory-module-storage.js";
 
 const trustedOrigin = "https://dashboard.example.test";
 const untrustedOrigin = "https://evil.example.test";
@@ -113,6 +114,7 @@ function buildModuleApp(options: {
     moduleUi: createModuleUiPublicationRegistry([]),
     moduleLifecycle: emptyModuleLifecycle(),
     moduleConfiguration: emptyModuleConfiguration(),
+    moduleStorage: emptyModuleStorage(),
     dashboard: createInMemoryDashboardStore(),
     runtime,
     trustedOrigins: options.trustedOrigins ?? [trustedOrigin],
@@ -339,17 +341,19 @@ describe("module route handler adaptation", () => {
     expect(body.url).toContain("/api/v1/modules/calendar/events/evt-1/rsvp?notify=true");
     expect(capturedRequest).toBeInstanceOf(Request);
     expect(capturedRequest?.headers.get("x-custom")).toBe("abc");
-    // Exactly config, moduleId, params, principal, services — and nothing else. `config` is this
-    // module's own frozen configuration snapshot, added deliberately by ADR 0029; a Hono Context,
-    // the authorization store or evaluator, raw PostgreSQL, platform configuration, and another
-    // module's configuration all remain unreachable, which is what this exact-shape assertion
-    // exists to keep true.
+    // Exactly config, moduleId, params, principal, services, storage — and nothing else. `config`
+    // is this module's own frozen configuration snapshot (ADR 0029) and `storage` its own scoped
+    // object storage (ADR 0030); a Hono Context, the authorization store or evaluator, raw
+    // PostgreSQL, the storage provider, an S3 endpoint or credential, platform configuration, and
+    // another module's configuration or storage all remain unreachable, which is what this
+    // exact-shape assertion exists to keep true.
     expect(Object.keys(capturedContext ?? {}).sort()).toEqual([
       "config",
       "moduleId",
       "params",
       "principal",
       "services",
+      "storage",
     ]);
     expect(capturedContext).toMatchObject({
       moduleId: "calendar",
@@ -366,6 +370,10 @@ describe("module route handler adaptation", () => {
     // This module declared no configuration, so its snapshot is empty rather than absent — module
     // code never has to branch on whether the platform supplied one.
     expect(capturedContext?.config.keys()).toEqual([]);
+    // Likewise storage: this module declared no buckets, so it gets a frozen facade that refuses
+    // every one rather than `undefined`.
+    expect(Object.isFrozen(capturedContext?.storage)).toBe(true);
+    expect(capturedContext?.storage.buckets()).toEqual([]);
   });
 
   it("gives static and root routes a frozen, empty params object", async () => {