Consolidate S3 storage configuration

[asim]

Summary

• use S3_ACCESS_KEY_ID / S3_SECRET_ACCESS_KEY as the canonical object-storage credentials
• keep the old Files credential names as migration fallbacks only
• make Files and backups share one object-store configuration
• give backups the fixed backups/ namespace; Files already owns files/
• remove S3_PREFIX and duplicate S3 credentials from the admin configuration surface
• update storage tests for the canonical credentials and fixed namespaces

This is the storage/config cleanup before adding SFTP to the existing SSH listener.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T10:17:56.017871Z	f4f182e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f4f182e643

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[asim]

Storage cleanup is ready for review at ae24ce2.

• removed the temporary branch-only workflow
• kept legacy Files credential names as scanner-hidden migration aliases
• documented only the canonical shared S3 credentials and removed S3_PREFIX from normal configuration
• preserved an existing per-instance S3_PREFIX at runtime to prevent upgrade collisions; new installs use backups/
• documented read/write/delete permission requirements for the shared credential
• made Files support AWS with no explicit S3_ENDPOINT, matching backups
• merged current main

CI: build, format, vet, internal/backup, internal/blob, and service/files pass. The full suite is red only on the existing home/TestTheNameIsTheSameOnEverySurface and internal/origin/TestURLPreservesExplicitPublicSurface failures; the S3 config scanner failures are gone.