feat(media): S3/MinIO storage adapter (StoragePort)

Drop-in S3-compatible backend for object storage (media + email attachments) —
the swap the StoragePort seam was designed for. MinIO/self-hosted/R2/Supabase all
work via endpoint + path-style.

- S3Storage implements StoragePort (put/get/remove); sha256 computed locally on put
  (matches LocalDiskStorage); a missing object reads back as null, not an error.
- Env-driven binding in MediaModule: IIOS_S3_BUCKET + keys set → S3Storage, else
  LocalDiskStorage. forcePathStyle defaults true (MinIO); endpoint omitted → AWS.
- S3 client is injectable so tests run with no live server.

6 unit tests (config parse, put size/sha, get round-trip, NoSuchKey→null, remove).
Full suite 300/300, boundary + build clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/iios-service/.env.example

@@ -59,3 +59,12 @@ IIOS_ATTESTATION_AUDIENCE=iios-core
 # When '1', every guarded request MUST carry a valid X-Context-Attestation (else 403).
 # Leave OFF until callers (AppShell/be-crm) forward attestations. Verified-if-present regardless.
 IIOS_REQUIRE_ATTESTATION=0
+
+# ─── Object storage (media + email attachments) ───────────────────
+# Unset → local disk (MEDIA_DIR). Set these → S3-compatible (AWS S3 / MinIO / R2 / Supabase).
+# IIOS_S3_ENDPOINT=https://minio.your-server:9000   # omit for AWS S3
+# IIOS_S3_BUCKET=iios-media
+# IIOS_S3_ACCESS_KEY=...
+# IIOS_S3_SECRET_KEY=...
+# IIOS_S3_REGION=us-east-1                            # any value for MinIO
+# IIOS_S3_FORCE_PATH_STYLE=true                       # true for MinIO/self-hosted