Verify M2/M3 implementation, fix regressions against M0/M1

Regressions fixed:
- gateway/src/worker.rs: missing session_manager field in AuthState (M3 regression)
- gateway/src/main.rs: same missing field in monolithic gateway
- storage/src/handlers.rs: removed unused validate_role (now handled by RlsTransaction)

M2 Storage Pillar — verified complete:
- StorageBackend trait with full API (put/get/delete/copy/head/list/multipart)
- AwsS3Backend implementation with streaming get_object
- StorageMode enum (Cloud/SelfHosted) in Config
- All routes: CRUD buckets, CRUD objects, copy, move, sign, public URL, health
- Bucket constraints: file_size_limit + allowed_mime_types enforced on upload
- TUS resumable uploads with S3 multipart (5MB chunking)
- Image transforms run via spawn_blocking
- docker-compose.pillar-storage.yml, templates/storage-node.yaml
- Shared Docker network on all pillar compose files

M3 Auth Completeness — verified complete:
- POST /logout revokes refresh tokens + Redis sessions
- GET /settings returns provider availability
- POST /magiclink with hashed token storage
- DELETE /user soft-delete with token revocation
- Recovery flow accepts new password
- Email change requires re-verification via token
- OAuth callback redirects with fragment tokens
- MFA verify returns aal2 JWT with amr claims
- MFA challenge validates factor ownership
- SessionManager wired into login/logout
- GET /sessions returns active sessions
- Configurable ACCESS_TOKEN_LIFETIME
- Claims model extended with session_id, aal, amr

Tests: 62 passed, 0 failed, 11 ignored (external services)
Warnings: 0
Made-with: Cursor

common/src/config.rs

@@ -1,6 +1,13 @@
 use serde::Deserialize;
 use std::env;
 
+#[derive(Clone, Debug, Default)]
+pub enum StorageMode {
+    Cloud,
+    #[default]
+    SelfHosted,
+}
+
 #[derive(Clone, Debug, Deserialize)]
 pub struct Config {
     pub database_url: String,
@@ -21,6 +28,13 @@ pub struct Config {
     pub discord_client_secret: Option<String>,
     pub redirect_uri: String,
     pub rate_limit_per_second: u64,
+    #[serde(skip)]
+    pub storage_mode: StorageMode,
+    pub s3_endpoint: String,
+    pub s3_access_key: String,
+    pub s3_secret_key: String,
+    pub s3_bucket: String,
+    pub s3_region: String,
 }
 
 impl Config {
@@ -58,6 +72,23 @@ impl Config {
         let redirect_uri = env::var("REDIRECT_URI")
             .unwrap_or_else(|_| "http://localhost:8000/auth/v1/callback".to_string());
 
+        let storage_mode = match env::var("STORAGE_MODE").unwrap_or_else(|_| "self-hosted".into()).as_str() {
+            "cloud" | "s3" => StorageMode::Cloud,
+            _ => StorageMode::SelfHosted,
+        };
+        let s3_endpoint = env::var("S3_ENDPOINT")
+            .unwrap_or_else(|_| "http://localhost:9000".to_string());
+        let s3_access_key = env::var("S3_ACCESS_KEY")
+            .or_else(|_| env::var("MINIO_ROOT_USER"))
+            .unwrap_or_default();
+        let s3_secret_key = env::var("S3_SECRET_KEY")
+            .or_else(|_| env::var("MINIO_ROOT_PASSWORD"))
+            .unwrap_or_default();
+        let s3_bucket = env::var("S3_BUCKET")
+            .unwrap_or_else(|_| "madbase".to_string());
+        let s3_region = env::var("S3_REGION")
+            .unwrap_or_else(|_| "us-east-1".to_string());
+
         Ok(Config {
             database_url,
             redis_url,
@@ -77,6 +108,12 @@ impl Config {
             discord_client_secret,
             redirect_uri,
             rate_limit_per_second,
+            storage_mode,
+            s3_endpoint,
+            s3_access_key,
+            s3_secret_key,
+            s3_bucket,
+            s3_region,
         })
     }
 }

common/src/lib.rs

@@ -4,6 +4,7 @@ pub mod db;
 pub mod error;
 pub mod rls;
 
-pub use cache::{CacheLayer, CacheError, CacheResult};
+pub use cache::{CacheLayer, CacheError, CacheResult, SessionData};
 pub use config::{Config, ProjectContext};
 pub use db::init_pool;
+pub use rls::RlsTransaction;