s3_backup_jobs had no bucket reference at all — the agent was never told
where to write, and object_lock_enabled was a dead per-job field pointing at
nothing (Object Lock is a bucket-level property, and with only one bucket
per agent a per-job WORM flag was meaningless).

Adds s3_bucket_id (immutable after creation, like s3_backup_agent_id/job_type).
BackupJobsService::resolveBucketForJob() defaults to the agent's own bucket
from registration, validates an explicit bucket belongs to the same account,
or provisions a brand-new dedicated WORM bucket via the existing
BucketsService when object_lock_enabled=true (Object Lock can't retroactively
apply to a bucket that already has other jobs' data in it). full_sync now
includes bucket_name per job so the agent actually knows the destination.