feat: migrate S3 from rust-s3 to rusty-s3

[digizeph]

Migrates the S3 implementation from rust-s3 to rusty-s3 (sans-IO signing + reqwest HTTP).

Key changes:

• Shared reqwest HTTP client (no duplicate HTTP stack)
• Single PUT for small files, multipart for large files
• Added s3_copy with proper AWS SigV4 Authorization header
• Added s3_exists and s3_delete
• New ONEIO_S3_MULTIPART_THRESHOLD env var
• Added R2 integration tests (ignored on CI)

Breaking changes:

• s3_bucket() returns S3Bucket
• s3_stats() returns S3ObjectMetadata
• Removed rust-s3 type re-exports

Tested against Cloudflare R2.

Fixes CopyObject failures on R2 caused by incorrect presigned URL signing.

[digizeph]

Addressed MAGI review issues in commit 211dc0f.

Critical fixes:

• Fixed CompleteMultipartUpload and CopyObject false-success bugs: now parse response body for embedded even on HTTP 200
• Fixed multipart upload leak: abort multipart on any part-upload or completion failure
• Fixed dotenvy filesystem hit: load .env once via OnceLock instead of on every S3 call

High priority fixes:

• Fixed s3_exists masking bucket errors: only NoSuchKey maps to false
• Fixed S3 feature without TLS: s3 now depends on https
• Fixed S3 client bypassing OneIo config: now honors ONEIO_CA_BUNDLE and ONEIO_ACCEPT_INVALID_CERTS
• Fixed missing rustls crypto provider init
• Fixed Debug leaking secrets: custom Debug redacts secret_key and session_token
• Fixed s3_copy dropping non-default ports
• Fixed VirtualHost breaking dotted buckets: fall back to path-style for buckets with dots

Medium priority fixes:

• upload_single now streams File directly instead of buffering entire file into memory
• Changed default multipart threshold from 8MB to 5MB (S3 minimum part size)
• Added 5GB CopyObject limit check
• Added 5-minute request timeout to S3 HTTP client
• Non-XML S3 errors now include raw response body text

[digizeph]

Round 3 fixes pushed (commit 121f69b).

• Fix multipart upload short-read bug: use take().read_to_end() instead of read() which could return fewer bytes than requested
• Reuse chunk buffer across multipart iterations instead of allocating 8MB per part
• Fix s3_exists string matching fragility: now checks HTTP status code directly (200 = true, 404 = false)
• Fix content_length == 0 incorrectly rejecting empty S3 objects
• Bump version to 0.22.0 for breaking API changes
• Map S3 HTTP errors to OneIoError::Status instead of NotSupported
• Added TODO to upstream CopyObject to rusty-s3 (rusty-s3 v0.9 does not provide CopyObject action or header-based signing)

[digizeph]

Round 4 fixes pushed (commit d9533b7).

• Add message field to OneIoError::Status variant to preserve S3 XML error detail
• map_parsed_s3_error now includes key/bucket/message context in error output (e.g., "Object not found: my-key.txt")
• Replace chunk.clone() with std::mem::take in multipart upload to avoid copying 8MB per part
• Remove redundant extract_etag fallback for uppercase ETag (reqwest normalizes to lowercase)
• Remove unnecessary authorization.clone() in s3_copy

All 13 S3 integration tests pass against R2.

[Copilot]

Pull request overview

This PR migrates OneIO’s S3 backend from rust-s3 to a rusty-s3 (signing) + reqwest (HTTP transport) implementation, adds missing S3 operations, and updates docs/tests to validate Cloudflare R2 compatibility.

Changes:

• Replaced the legacy src/s3.rs implementation with a new src/s3/ module using rusty-s3 signing + shared reqwest::blocking::Client.
• Added/updated S3 operations (multipart upload thresholding, copy with SigV4 Authorization header, exists/delete/list/stats) and improved S3 error parsing/messaging.
• Added ignored R2 integration tests and updated CLI/docs/CHANGELOG for the new behavior and breaking API changes.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
Cargo.toml	Swaps rust-s3 for rusty-s3 + XML/signing deps; wires feature flags and adds an S3 integration test target.
src/s3/mod.rs	New S3 implementation (signing, reqwest transport, multipart upload, copy/delete/exists/list/stats, XML error parsing).
src/s3/config.rs	New S3 config/credential loading and endpoint normalization.
src/s3.rs	Removes the previous rust-s3-based implementation.
src/error.rs	Extends OneIoError::Status to carry an optional message and removes old rust-s3 conversions.
src/client.rs	Updates S3 content-length handling to match new s3_stats() return type.
src/bin/oneio.rs	Fixes a short-flag collision for the S3 list delimiter option.
tests/s3_integration.rs	Adds ignored Cloudflare R2 integration tests covering uploads/downloads/list/head/copy/delete/error cases.
examples/s3_operations.rs	Updates the S3 example to exercise the expanded API and print detailed failures.
src/lib.rs	Updates docs/examples and documents S3 environment variables.
README.md	Updates version snippets and expands S3 usage/config docs.
CHANGELOG.md	Documents the migration, breaking changes, and behavior changes.
specs/rusty-s3-migration/README.md	Adds the migration spec and implementation notes.
specs/README.md	Adds a specs index.
AGENTS.md	Adds repository development/process guidelines for contributors/agents.
.gitignore	Ignores .env.local.