s3: implement count_by_tenant so deregistered tenants with data stay visible (and purgeable)

[angela-helios]

The tenant-maintenance page lists data-discovered tenants — rows with data but no registration — flagged unregistered, so leftover data is visible and purgeable (that model shipped in #252: a plain deregister leaves the tenant data-discovered; purge removes it entirely).

That discovery is fed by ResourceStorage::count_by_tenant, which the S3 backend does not override (the trait default returns empty). Consequence on S3: deregistering a tenant without purge makes its data invisible — the row (and with it the purge button) disappears from the UI while the tenant's objects (~1.4k seeded conformance resources plus any real data) remain in the bucket, orphaned, cleanable only with direct bucket access. Found by the #290 browser matrix; the e2e spec currently tolerates both renderings.

Suggested implementation

• Shared-bucket mode: enumerate tenant prefixes with one delimiter LIST, then count keys per tenant with paginated LISTs — no per-object GETs (see perf(s3): page-level reads go O(N) over the bucket once conformance is seeded #326 for why that matters).
• Bucket-per-tenant mode without a default system bucket: may stay unsupported, matching the existing tenant-registry carve-out there.
• Once implemented, tighten the e2e deregister assertion back to expecting the unregistered row on every backend.

Relates to #252, #290, #326.