feat: add host-provided module object storage

`manifest.storage.buckets` has existed since manifest version 1 and meant
nothing — discovery validated it and no code read it. This turns it into a
real capability, which is what stands between Announcements and the module
system: that product currently fetches a hardcoded LAN S3 endpoint, parses
ListObjectsV2 XML by hand, and hands the browser direct object URLs.

- A module declares a logical bucket and receives a scoped facade at
  `context.storage` — list, head, get, put, delete. The contract names no
  provider: no endpoint, region, credential, or physical bucket is reachable
  from it, which is what lets the same module run under a future standalone
  host over its own or a shared S3-compatible service.
- Core's first provider speaks S3 through the AWS SDK. SeaweedFS is the
  deployment target (ADR 0004), never an API name. Probing the pinned image
  found `CreateBucket` reporting `BucketAlreadyExists` rather than AWS's
  `BucketAlreadyOwnedByYou`; treating only the AWS spelling as success would
  have failed every second boot. A live test pins it.
- Logical → physical mapping is deterministic and collision-safe: an
  installation prefix, the module and bucket ids joined by `--` (which cannot
  occur inside either identifier, so `a-b`+`c` and `a`+`b-c` cannot collide),
  and a digest over the full untruncated identity. Two modules declaring
  `assets` always get separate namespaces; neither can see the physical name.
- Declaring a bucket is now a requirement: with no provider configured the
  module is `blocked · storage_unavailable` through ADR 0028's existing
  resolver, propagating to required dependents. An installation with no object
  storage stays a complete deployment.
- Binding availability is not provider health. Eligibility asks whether
  storage is configured, never whether it answered; bucket creation is lazy on
  first use so a storage outage cannot stop the platform booting; a running
  module whose store blinks stays running and retries. Nothing deletes a
  bucket.
- Credentials are deployment-supplied, never persisted, never routed through
  module configuration, and never visible to modules, module UI, diagnostics,
  or API responses. Provider errors translate to a closed code set carrying no
  endpoint, bucket, request id, or XML.
- Retires ADR 0029's transitional `bucket` configuration key. No manifest
  version change. The template declares no bucket, so it still runs without S3.

See ADR 0030.

Co-Authored-By: Claude Opus 5 <[email protected]>

core/src/modules/runtime.ts

@@ -2,7 +2,9 @@ import { pathToFileURL } from "node:url";
 import {
   type CapabilityId,
   EMPTY_MODULE_CONFIGURATION,
+  EMPTY_MODULE_STORAGE,
   type ModuleConfiguration,
+  type ModuleStorage,
   type CapabilityRegistrar,
   type CapabilityResolver,
   capabilityIdSchema,
@@ -96,6 +98,20 @@ function configurationFor(
   return configurations.get(moduleId) ?? EMPTY_MODULE_CONFIGURATION;
 }
 
+/**
+ * Per-module scoped object storage, keyed by module id (ADR 0030).
+ *
+ * A lookup for the same reason configuration is one, and emphatically **not** a field on
+ * `ModuleRuntimeServices`: `services` is one shared object identity every module receives, while a
+ * storage facade is scoped to exactly the buckets one module declared. Sharing it would hand every
+ * module every other module's storage.
+ */
+export type ModuleStorageLookup = ReadonlyMap<string, ModuleStorage>;
+
+function storageFor(storages: ModuleStorageLookup, moduleId: string): ModuleStorage {
+  return storages.get(moduleId) ?? EMPTY_MODULE_STORAGE;
+}
+
 export interface ModuleRuntimeTimeoutOptions {
   /** Test-only narrowing of `MODULE_STOP_HOOK_TIMEOUT_MS`, applied to both normal stop and startup
    * rollback, so a deadline can be proven in milliseconds instead of ten seconds. Production
@@ -115,6 +131,12 @@ export interface ModuleRuntimeCompositionOptions extends ModuleRuntimeTimeoutOpt
    * `EMPTY_MODULE_CONFIGURATION`.
    */
   readonly configurations?: ModuleConfigurationLookup;
+  /**
+   * The per-module scoped storage facades this runtime hands to each module's `start`, `stop`, and
+   * HTTP handler contexts (ADR 0030). Omitted by a caller exercising no storage; every module then
+   * receives `EMPTY_MODULE_STORAGE`, which refuses every bucket.
+   */
+  readonly storages?: ModuleStorageLookup;
 }
 
 export interface StartModuleRuntimeOptions
@@ -257,6 +279,7 @@ class StagedCapabilityRegistry {
     phase: "rollback" | "start" | "stop",
     services: ModuleRuntimeServices,
     config: ModuleConfiguration,
+    storage: ModuleStorage,
   ): ModuleRuntimeContext {
     const capabilities: CapabilityResolver = Object.freeze({
       resolve: (capabilityId: CapabilityId): RegisteredCapability | undefined => {
@@ -264,7 +287,13 @@ class StagedCapabilityRegistry {
         return this.#registered.get(capabilityId);
       },
     });
-    return Object.freeze({ capabilities, config, moduleId: module.manifest.id, services });
+    return Object.freeze({
+      capabilities,
+      config,
+      moduleId: module.manifest.id,
+      services,
+      storage,
+    });
   }
 
   publish(): CapabilityRegistry {
@@ -599,6 +628,7 @@ async function stopModules(
   phase: "rollback" | "stop",
   services: ModuleRuntimeServices,
   configurations: ModuleConfigurationLookup,
+  storages: ModuleStorageLookup,
   options: StopModulesOptions = {},
 ): Promise<readonly ModuleRuntimeIssue[]> {
   const timeoutMs = options.hookTimeoutMs ?? MODULE_STOP_HOOK_TIMEOUT_MS;
@@ -619,6 +649,7 @@ async function stopModules(
               phase,
               services,
               configurationFor(configurations, moduleId),
+              storageFor(storages, moduleId),
             ),
           ),
         ),
@@ -657,6 +688,7 @@ async function startModules(
   registry: StagedCapabilityRegistry,
   services: ModuleRuntimeServices,
   configurations: ModuleConfigurationLookup,
+  storages: ModuleStorageLookup,
   options: StopModulesOptions = {},
 ): Promise<void> {
   // A module joins the rollback set the moment its `start` hook is *invoked*, not when it
@@ -675,6 +707,7 @@ async function startModules(
           "start",
           services,
           configurationFor(configurations, module.discovered.manifest.id),
+          storageFor(storages, module.discovered.manifest.id),
         ),
       );
     } catch (error) {
@@ -693,6 +726,7 @@ async function startModules(
         "rollback",
         services,
         configurations,
+        storages,
         options,
       );
       throw new ModuleRuntimeError([startIssue, ...rollbackIssues]);
@@ -717,8 +751,9 @@ export async function startDiscoveredModuleRuntime(
   const capabilityRegistry = new StagedCapabilityRegistry();
   const httpRoutes = new StagedModuleHttpRoutes();
   const configurations = timeouts.configurations ?? new Map<string, ModuleConfiguration>();
+  const storages = timeouts.storages ?? new Map<string, ModuleStorage>();
   await registerModules(modules, capabilityRegistry, httpRoutes, configurations);
-  await startModules(modules, capabilityRegistry, services, configurations, timeouts);
+  await startModules(modules, capabilityRegistry, services, configurations, storages, timeouts);
 
   const capabilities = capabilityRegistry.publish();
   const routes = httpRoutes.publish();
@@ -744,6 +779,7 @@ export async function startDiscoveredModuleRuntime(
           "stop",
           services,
           configurations,
+          storages,
           timeouts,
         );
         if (issues.length > 0) {
@@ -761,6 +797,7 @@ export async function startModuleRuntime(
   const discovered = await discoverModules(options);
   return startDiscoveredModuleRuntime(discovered, options.services, {
     ...(options.configurations === undefined ? {} : { configurations: options.configurations }),
+    ...(options.storages === undefined ? {} : { storages: options.storages }),
     ...(options.hookTimeoutMs === undefined ? {} : { hookTimeoutMs: options.hookTimeoutMs }),
   });
 }