Replace Vercel Blob with Cloudflare R2 for media uploads

Hall uses the existing Our.one R2 bucket (accessed via cdn.our.one)
for hero image / video uploads. R2 is cheaper at scale (free egress)
than Vercel Blob and avoids running a parallel CDN — same bucket the
marketing site already uses for user avatars and other assets.

Implementation:
- @vercel/blob removed, @aws-sdk/client-s3 added (R2 is S3-compatible)
- src/lib/blob.ts → src/lib/r2.ts. Same upload interface; the server
  action and post editor are unchanged.
- Bucket key prefix `hall/posts/` namespaces our uploads so they don't
  collide with avatars or future products that share the bucket.
- Filenames sanitized to alphanumeric + . _ -, capped at 80 chars,
  prefixed with a ULID to avoid collisions.
- Returned URL is built from R2_PUBLIC_URL (cdn.our.one), not the
  raw R2 endpoint.
- Cache-control: public, immutable, 1-year max-age. Assets are
  content-hashed by the ULID prefix so safe to cache forever.

Required env vars on Hall's Vercel project (same names as marketing):
- R2_ACCOUNT_ID
- R2_ACCESS_KEY_ID
- R2_SECRET_ACCESS_KEY
- R2_BUCKET_NAME
- R2_PUBLIC_URL

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: radosukala