storage: S3 client wrapper and admin Basic-auth middleware

S3 module wraps aws-sdk-s3 against MinIO. Two clients on purpose:

- The bytes-mover client points at S3_ENDPOINT (internal minio:9000 over
  the storage Docker network).
- The presign-only client points at S3_PUBLIC_ENDPOINT (https://s3.asxp.io
  via Traefik) so the URLs it mints resolve from a browser.

force_path_style on both because subdomain-style URLs would require wildcard
DNS under s3.asxp.io.

AdminAuth is a tiny Rack middleware that 401s any request under /admin
unless HTTP Basic credentials match ADMIN_USER / ADMIN_PASSWORD from env.
Fails closed if either env var is missing.

lib/admin_auth.rb

@@ -0,0 +1,24 @@
+require 'rack/auth/basic'
+
+# Rack middleware that gates everything under /admin/* behind HTTP Basic.
+# Credentials come from ENV at boot; missing vars fail closed (401 always).
+class AdminAuth
+  def initialize(app)
+    @app  = app
+    @user = ENV['ADMIN_USER']
+    @pass = ENV['ADMIN_PASSWORD']
+  end
+
+  def call(env)
+    return @app.call(env) unless env['PATH_INFO'].to_s.start_with?('/admin')
+
+    auth = Rack::Auth::Basic::Request.new(env)
+    if @user && @pass && auth.provided? && auth.basic? && auth.credentials == [@user, @pass]
+      @app.call(env)
+    else
+      [401,
+       { 'content-type' => 'text/plain', 'www-authenticate' => 'Basic realm="asxp.io admin"' },
+       ["Unauthorized\n"]]
+    end
+  end
+end