fix(storage): make s3 disks work with S3-compatible endpoints (RustFS, MinIO) and AWS_* env

[kangmaup]

Summary

s3 disks could not be used against an S3-compatible service in local development (RustFS, MinIO), and the AWS_* variables that .env.example documents were never read. This PR fixes both. It also redacts the S3 secret from Debug output, validates the bucket, adds a Docker-backed RustFS test suite and a storage-s3 umbrella feature, and makes CI compile the opt-in storage drivers.

Problems

1. http:// endpoints always failed. object_store enforces HTTPS unless allow_http is set (ClientOptions builds its client with https_only(!allow_http)), and build_s3 never set it. The documented example in config/storage.toml (endpoint = "http://localhost:9000") failed every request:

   Error performing PUT http://127.0.0.1:32774/rustasea-test/reports/2026/hello.txt in 46.854µs - HTTP error: builder error
   

2. AWS_* variables were ignored. .env.example says "The app reads the S3 credentials from the AWS_* variables above when the s3 disk is used", and the scaffolded docker-compose.yml passes AWS_ENDPOINT to the app. But StorageManager::from_toml_file parses the TOML as-is and the builder used AmazonS3Builder::new() (not from_env()), so nothing was read. A disk without inline credentials fell back to EC2 instance metadata:

   Error performing PUT http://169.254.169.254/latest/api/token in 12.781797967s, after 10 retries
   

3. The secret leaked through Debug. S3DiskConfig derived Debug, so any debug dump of the storage config printed secret_access_key. SftpDiskConfig already redacts its password.
4. CI never compiled the aws (or sftp) feature, so none of this was caught.

Changes

Five commits:

1. refactor(storage), no behaviour change. S3DiskConfig moves verbatim to a new rustasea_storage::s3 module, mirroring sftp/config.rs, and stays re-exported from facade and the crate root. env_non_empty and the with_env test helper become shared.
2. fix(storage):
   • Env overlay. apply_env() overlays AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION, AWS_BUCKET, and AWS_ENDPOINT onto every s3 disk. Blank values are ignored and env wins over the file, the same semantics as the SFTP_* overlay.
   • Plain HTTP. An explicit http:// endpoint (surrounding whitespace ignored) enables allow_http. Any other endpoint, and AWS itself, stays HTTPS-only. No new config key.
   • Debug redaction. A manual Debug impl redacts secret_access_key.
   • Validation. validate() runs after the overlay, as for SFTP. bucket may be omitted when AWS_BUCKET supplies it, and a blank bucket is a StorageError::Config instead of a store with a malformed URL.
3. feat(rustasea): new umbrella feature storage-s3 = ["rustasea-storage/aws"], next to storage-sftp, plus docs.
4. ci: cargo xtask ci lints rustasea-storage --features aws,sftp, and the test job runs cargo test -p rustasea-storage --features aws,sftp. CONTRIBUTING and the README describe the new steps and the storage suites.
5. docs: CHANGELOG.

Testing

• Unit tests (no network):

  • env overlay mapping, and blank values ignored
  • allow_http per endpoint (http://, HTTP://, padded http://, https://, none)
  • Debug redaction
  • build_s3 applying the overlay (checked through the built disk's label)
  • a bucket supplied only by AWS_BUCKET
  • a blank bucket rejected

  Mutation-checked: skipping apply_env in build_s3, never enabling allow_http, and always enabling it each fail a test.

• tests/rustfs_container.rs against rustfs/rustfs:1.0.0, #[ignore]d like the SFTP suite. It round-trips put/get/exists/delete over a plain-HTTP endpoint twice: once with inline credentials, once with a disk that names only its driver and gets everything else from AWS_*. Both tests fail on master with the errors above and pass with this PR.

  cargo test -p rustasea-storage --features aws --test rustfs_container -- --ignored
  

• Other checks: cargo xtask ci, cargo test -p rustasea-storage --features aws,sftp, cargo +1.88.0 check --workspace, cargo deny check, and cargo audit pass locally.

• cargo test --workspace --no-fail-fast: 3 failures, and all three also fail on master (c501fdd) without this PR. They are why the Test (workspace) CI job is currently red there:

  • artisan_alias_generates_livewire_app: crates/rustasea/tests/cli.rs:146 still expects features = ["view", "broadcast"]. The scaffold has emitted ["view", "action"] since ab02ac6, and the umbrella has no broadcast feature.
  • routes::tests::two_factor::enable_confirm_challenge_and_recovery_lifecycle: login hits 429, because the login rate limiter is a process-wide static shared across tests.
  • tests::workers_renders_heartbeats in rustasea-queue-dashboard.

  I'll send fixes for those in a separate PR.

Notes

• Behaviour change. AWS_* values now override the matching keys in config/storage.toml. The stock .env.example sets AWS_DEFAULT_REGION=us-east-1, so the region is changed there. With more than one s3 disk, AWS_BUCKET/AWS_ENDPOINT would override every disk; the docs say to leave them blank in that case. Happy to scope the overlay to a single disk if you prefer.
• MSRV. The aws feature needs rustc 1.89. object_store's AWS backend depends on crc-fast, and the lockfile has 1.10.0, which declares rust-version = 1.89. This predates this PR, which only documents it.
  • Pinning crc-fast to 1.9.0 (MSRV 1.81) is possible but also forces crc down to 3.3.0 under sqlx-core.
  • A lockfile pin does not help downstream apps, which resolve their own lockfile.
  • So I left the lockfile alone. Tell me if you would rather pin.
• Cargo.lock is unchanged. The RustFS suite sends its signed CreateBucket request through object_store's own HTTP client.
• Possible follow-ups, out of scope here: temporary_url (presigned URLs), AWS_SESSION_TOKEN and IRSA/ECS credential chains, and swapping the docker-compose minio service for RustFS.

[kangmaup]

Heads-up on the red checks: none of them come from this PR, and all of them also fail on master:

• Test (workspace): three tests are already broken on master (see "Testing" above). This PR's new step, cargo test -p rustasea-storage --features aws,sftp, was skipped because the earlier step failed.
• cargo-deny: since TASK-115 the workflow sets RUSTC_WRAPPER: sccache for every job, but the deny job doesn't install sccache. cargo deny runs cargo metadata, which runs sccache rustc -vV and fails. cargo-audit passes because it never calls cargo metadata. Reproduced locally with RUSTC_WRAPPER=sccache cargo deny check.
• Assign vheins as reviewer: pull_request runs from forks only get a read-only token, so requestReviewers fails with "Resource not accessible by integration". pull_request_target would fix it, since the job never checks out PR code.

I'll open a separate PR that fixes all three so master is green again.