Verify M2/M3 implementation, fix regressions against M0/M1

Regressions fixed:
- gateway/src/worker.rs: missing session_manager field in AuthState (M3 regression)
- gateway/src/main.rs: same missing field in monolithic gateway
- storage/src/handlers.rs: removed unused validate_role (now handled by RlsTransaction)

M2 Storage Pillar — verified complete:
- StorageBackend trait with full API (put/get/delete/copy/head/list/multipart)
- AwsS3Backend implementation with streaming get_object
- StorageMode enum (Cloud/SelfHosted) in Config
- All routes: CRUD buckets, CRUD objects, copy, move, sign, public URL, health
- Bucket constraints: file_size_limit + allowed_mime_types enforced on upload
- TUS resumable uploads with S3 multipart (5MB chunking)
- Image transforms run via spawn_blocking
- docker-compose.pillar-storage.yml, templates/storage-node.yaml
- Shared Docker network on all pillar compose files

M3 Auth Completeness — verified complete:
- POST /logout revokes refresh tokens + Redis sessions
- GET /settings returns provider availability
- POST /magiclink with hashed token storage
- DELETE /user soft-delete with token revocation
- Recovery flow accepts new password
- Email change requires re-verification via token
- OAuth callback redirects with fragment tokens
- MFA verify returns aal2 JWT with amr claims
- MFA challenge validates factor ownership
- SessionManager wired into login/logout
- GET /sessions returns active sessions
- Configurable ACCESS_TOKEN_LIFETIME
- Claims model extended with session_id, aal, amr

Tests: 62 passed, 0 failed, 11 ignored (external services)
Warnings: 0
Made-with: Cursor

storage/src/lib.rs

@@ -2,65 +2,49 @@ pub mod backend;
 pub mod handlers;
 pub mod tus;
 
-use aws_config::BehaviorVersion;
-use aws_sdk_s3::config::Credentials;
-use aws_sdk_s3::{config::Region, Client};
-use axum::{extract::DefaultBodyLimit, routing::{get, post, patch}, Router};
+use axum::{extract::DefaultBodyLimit, routing::{delete, get, post, patch}, Router};
 use common::Config;
 use handlers::StorageState;
 use sqlx::PgPool;
+use std::sync::Arc;
+use crate::backend::{AwsS3Backend, StorageBackend};
 
 pub async fn init(db: PgPool, config: Config) -> Router {
-    // Initialize S3 Client (MinIO)
-    let s3_endpoint =
-        std::env::var("S3_ENDPOINT").unwrap_or_else(|_| "http://localhost:9000".to_string());
-    let s3_access_key =
-        std::env::var("MINIO_ROOT_USER").unwrap_or_else(|_| "minioadmin".to_string());
-    let s3_secret_key =
-        std::env::var("MINIO_ROOT_PASSWORD").unwrap_or_else(|_| "minioadmin".to_string());
-    let s3_bucket = std::env::var("S3_BUCKET").unwrap_or_else(|_| "madbase".to_string());
-
-    let aws_config = aws_config::defaults(BehaviorVersion::latest())
-        .region(Region::new("us-east-1"))
-        .endpoint_url(&s3_endpoint)
-        .credentials_provider(Credentials::new(
-            s3_access_key,
-            s3_secret_key,
-            None,
-            None,
-            "static",
-        ))
-        .load()
-        .await;
-
-    let s3_config = aws_sdk_s3::config::Builder::from(&aws_config)
-        .endpoint_url(&s3_endpoint)
-        .force_path_style(true)
-        .build();
-
-    let s3_client = Client::from_conf(s3_config);
-
+    // Initialize S3 Backend
+    let backend: Arc<dyn StorageBackend> = Arc::new(
+        AwsS3Backend::new(&config).await.expect("Failed to init storage backend")
+    );
+    
+    let bucket_name = config.s3_bucket.clone();
+    
     // Create bucket if not exists
-    let _ = s3_client.create_bucket().bucket(&s3_bucket).send().await;
+    let _ = backend.create_bucket(&bucket_name).await;
 
-    let state = StorageState {
-        db,
-        s3_client,
-        config,
-        bucket_name: s3_bucket,
-    };
+    let state = StorageState { db, backend, config, bucket_name };
 
     Router::new()
-        .route("/bucket", get(handlers::list_buckets))
+        // Health check
+        .route("/health", get(handlers::health_check))
+        // Bucket operations
+        .route("/bucket", get(handlers::list_buckets).post(handlers::create_bucket))
+        .route("/bucket/:bucket_id", delete(handlers::delete_bucket))
+        // Object operations
         .route("/object/list/:bucket_id", post(handlers::list_objects))
         .route(
             "/object/sign/:bucket_id/*filename",
             post(handlers::sign_object).get(handlers::get_signed_object),
         )
         .route(
-            "/object/:bucket_id/*filename",
-            get(handlers::download_object).post(handlers::upload_object),
+            "/object/public/:bucket_id/*filename",
+            get(handlers::get_public_url),
         )
+        .route(
+            "/object/:bucket_id/*filename",
+            get(handlers::download_object).post(handlers::upload_object).delete(handlers::delete_object),
+        )
+        // Copy and move operations
+        .route("/object/copy", post(handlers::copy_object))
+        .route("/object/move", post(handlers::move_object))
         // TUS Resumable Uploads
         .route("/upload/resumable", post(tus::tus_create_upload).options(tus::tus_options))
         .route("/upload/resumable/:upload_id",