feat: add host-provided module object storage

`manifest.storage.buckets` has existed since manifest version 1 and meant
nothing — discovery validated it and no code read it. This turns it into a
real capability, which is what stands between Announcements and the module
system: that product currently fetches a hardcoded LAN S3 endpoint, parses
ListObjectsV2 XML by hand, and hands the browser direct object URLs.

- A module declares a logical bucket and receives a scoped facade at
  `context.storage` — list, head, get, put, delete. The contract names no
  provider: no endpoint, region, credential, or physical bucket is reachable
  from it, which is what lets the same module run under a future standalone
  host over its own or a shared S3-compatible service.
- Core's first provider speaks S3 through the AWS SDK. SeaweedFS is the
  deployment target (ADR 0004), never an API name. Probing the pinned image
  found `CreateBucket` reporting `BucketAlreadyExists` rather than AWS's
  `BucketAlreadyOwnedByYou`; treating only the AWS spelling as success would
  have failed every second boot. A live test pins it.
- Logical → physical mapping is deterministic and collision-safe: an
  installation prefix, the module and bucket ids joined by `--` (which cannot
  occur inside either identifier, so `a-b`+`c` and `a`+`b-c` cannot collide),
  and a digest over the full untruncated identity. Two modules declaring
  `assets` always get separate namespaces; neither can see the physical name.
- Declaring a bucket is now a requirement: with no provider configured the
  module is `blocked · storage_unavailable` through ADR 0028's existing
  resolver, propagating to required dependents. An installation with no object
  storage stays a complete deployment.
- Binding availability is not provider health. Eligibility asks whether
  storage is configured, never whether it answered; bucket creation is lazy on
  first use so a storage outage cannot stop the platform booting; a running
  module whose store blinks stays running and retries. Nothing deletes a
  bucket.
- Credentials are deployment-supplied, never persisted, never routed through
  module configuration, and never visible to modules, module UI, diagnostics,
  or API responses. Provider errors translate to a closed code set carrying no
  endpoint, bucket, request id, or XML.
- Retires ADR 0029's transitional `bucket` configuration key. No manifest
  version change. The template declares no bucket, so it still runs without S3.

See ADR 0030.

Co-Authored-By: Claude Opus 5 <[email protected]>

core/tests/doctor.test.ts

@@ -138,6 +138,7 @@ function dependencies(overrides: Partial<DoctorDependencies> = {}): DoctorDepend
     discoverModules: vi.fn(async () => Object.freeze([])),
     discoverSchemas: vi.fn(async () => schemaAggregate()),
     planMigrations: vi.fn(async () => plan()),
+    probeStorage: vi.fn(async () => undefined),
     readModuleConfiguration: vi.fn(async () => Object.freeze({ records: Object.freeze([]) })),
     readModuleLifecycle: vi.fn(async () => Object.freeze({ modules: Object.freeze([]) })),
     runtimeSatisfies: vi.fn(() => true),
@@ -217,6 +218,7 @@ describe("Ekklesia Doctor diagnostics", () => {
       "identity.configuration",
       "identity.client-address",
       "object-storage.integration",
+      "object-storage.bindings",
     ]);
     expect(check(report, "modules.discovery").details).toEqual(["people 0.1.0", "calendar 0.2.0"]);
     expect(check(report, "modules.dependencies").details).toEqual(["Order: people → calendar"]);
@@ -553,15 +555,19 @@ describe("Ekklesia Doctor diagnostics", () => {
     expect(serialized).not.toContain("also-secret.invalid");
   });
 
-  it("always reports object storage as unavailable without probing configuration", async () => {
-    const report = await diagnoseEkklesia(options(), dependencies());
+  it("skips the storage check, without probing, when no provider is configured", async () => {
+    const services = dependencies();
+    const report = await diagnoseEkklesia(options(), services);
 
     expect(check(report, "object-storage.integration")).toEqual({
-      details: ["Core storage integration has not been implemented yet."],
+      details: [
+        "No S3_ENDPOINT is set. This is a complete deployment unless a module requires storage.",
+      ],
       id: "object-storage.integration",
       status: "skipped",
-      summary: "Check unavailable",
+      summary: "Object storage not configured",
     });
+    expect(services.probeStorage).not.toHaveBeenCalled();
   });
 
   it("continues static discovery when runtime validation fails", async () => {
@@ -1208,3 +1214,164 @@ describe("Ekklesia Doctor — module configuration", () => {
     );
   });
 });
+
+describe("Ekklesia Doctor — object storage", () => {
+  const storageConfig = {
+    accessKey: "AKIAEXAMPLEACCESSID",
+    bucketPrefix: "ekklesia",
+    endpoint: "https://storage.example.test",
+    forcePathStyle: true,
+    region: "us-east-1",
+    secretKey: "sk-example-secret-material",
+  } as const;
+
+  function storingModule(id: string, buckets: readonly string[]): DiscoveredModule {
+    const base = discoveredModule(id);
+    return {
+      ...base,
+      manifest: {
+        ...base.manifest,
+        storage: { buckets: buckets.map((bucketId) => ({ id: bucketId })) },
+      } as unknown as ModuleManifest,
+    };
+  }
+
+  it("does not probe, and stays healthy, when no provider is configured and nothing needs one", async () => {
+    const services = dependencies({
+      discoverModules: vi.fn(async () => Object.freeze([discoveredModule("calendar")])),
+    });
+
+    const report = await diagnoseEkklesia(options(databaseUrl), services);
+
+    expect(services.probeStorage).not.toHaveBeenCalled();
+    expect(check(report, "object-storage.integration").status).toBe("skipped");
+    // The load-bearing assertion: an installation whose modules need no object storage is not
+    // unhealthy for lacking a provider.
+    expect(check(report, "object-storage.bindings").status).toBe("pass");
+    expect(check(report, "object-storage.bindings").details).toEqual([
+      "0 modules declare a logical storage bucket.",
+    ]);
+  });
+
+  it("fails the bindings check when a module requires storage and none is configured", async () => {
+    const services = dependencies({
+      discoverModules: vi.fn(async () =>
+        Object.freeze([storingModule("announcements", ["announcement-assets"])]),
+      ),
+    });
+
+    const report = await diagnoseEkklesia(options(databaseUrl), services);
+    const bindings = check(report, "object-storage.bindings");
+
+    expect(bindings.status).toBe("failure");
+    expect(bindings.details[0]).toContain("Configure an S3-compatible Ekklesia storage provider");
+    expect(bindings.details).toContain(
+      "announcements · announcement-assets · unbound (no storage provider configured)",
+    );
+    // And the lifecycle check agrees, because both come from one resolution.
+    expect(check(report, "modules.lifecycle").details).toContain(
+      "announcements 0.1.0 · blocked · storage_unavailable · announcement-assets",
+    );
+  });
+
+  it("resolves and lists every binding when a provider is configured", async () => {
+    const services = dependencies({
+      discoverModules: vi.fn(async () =>
+        Object.freeze([storingModule("announcements", ["announcement-assets"])]),
+      ),
+    });
+
+    const report = await diagnoseEkklesia(
+      { ...options(databaseUrl), storage: storageConfig },
+      services,
+    );
+    const bindings = check(report, "object-storage.bindings");
+
+    expect(bindings.status).toBe("pass");
+    // The physical bucket is named here deliberately: Doctor is an operator tool, and someone
+    // debugging a permissions problem needs to know which bucket to look at. It is still never
+    // reachable from module-facing code.
+    expect(bindings.details[0]).toMatch(
+      /^announcements · announcement-assets → ekklesia-announcements--announcement-assets-[0-9a-f]{12}$/u,
+    );
+  });
+
+  it("probes a configured provider and reports it reachable, without printing a credential", async () => {
+    const services = dependencies({
+      discoverModules: vi.fn(async () => Object.freeze([discoveredModule("calendar")])),
+    });
+
+    const report = await diagnoseEkklesia(
+      { ...options(databaseUrl), storage: storageConfig },
+      services,
+    );
+    const integration = check(report, "object-storage.integration");
+
+    expect(services.probeStorage).toHaveBeenCalledWith(storageConfig);
+    expect(integration.status).toBe("pass");
+    expect(integration.details[0]).toContain("https://storage.example.test");
+    const serialized = JSON.stringify(integration);
+    expect(serialized).not.toContain("AKIAEXAMPLEACCESSID");
+    expect(serialized).not.toContain("sk-example-secret-material");
+  });
+
+  it("warns rather than fails when a configured provider is unreachable", async () => {
+    const services = dependencies({
+      discoverModules: vi.fn(async () => Object.freeze([discoveredModule("calendar")])),
+      probeStorage: vi.fn(async () => {
+        throw new Error("connect ECONNREFUSED 10.40.0.2:8333 accessKey=AKIAEXAMPLEACCESSID");
+      }),
+    });
+
+    const report = await diagnoseEkklesia(
+      { ...options(databaseUrl), storage: storageConfig },
+      services,
+    );
+    const integration = check(report, "object-storage.integration");
+
+    // A warning, never a failure. A momentary network blip must not make the whole platform read as
+    // NOT READY, and it must never look like a module problem (ADR 0030).
+    expect(integration.status).toBe("warning");
+    expect(report.result).not.toBe("not-ready");
+    expect(integration.details).toContain(
+      "The configured storage service did not respond. Modules already running are unaffected.",
+    );
+    const serialized = JSON.stringify(integration);
+    expect(serialized).not.toContain("AKIAEXAMPLEACCESSID");
+    expect(serialized).not.toContain("10.40.0.2");
+  });
+
+  it("still resolves bindings when the provider is unreachable, because binding is not health", async () => {
+    const services = dependencies({
+      discoverModules: vi.fn(async () =>
+        Object.freeze([storingModule("announcements", ["announcement-assets"])]),
+      ),
+      probeStorage: vi.fn(async () => {
+        throw new Error("unreachable");
+      }),
+    });
+
+    const report = await diagnoseEkklesia(
+      { ...options(databaseUrl), storage: storageConfig },
+      services,
+    );
+
+    expect(check(report, "object-storage.integration").status).toBe("warning");
+    // The module is still eligible: a configured-but-briefly-unreachable provider is an operational
+    // condition, not a lifecycle state.
+    expect(check(report, "object-storage.bindings").status).toBe("pass");
+    expect(check(report, "modules.lifecycle").details).toContain("announcements 0.1.0 · enabled");
+  });
+
+  it("skips bindings when discovery itself failed", async () => {
+    const services = dependencies({
+      discoverModules: vi.fn(async () => {
+        throw new Error("broken inventory");
+      }),
+    });
+
+    const report = await diagnoseEkklesia(options(databaseUrl), services);
+
+    expect(check(report, "object-storage.bindings").status).toBe("skipped");
+  });
+});