[P0][blossom] Deploy Blossom repair and verify public authenticated upload + retrieval

[psam21]

Migrated from docs/pending-work-plan.md §2.4 + §10 step 3.

Goal

Ship the rule repair (#102) and the upload test matrix (#103) to production, then prove the public hostname accepts and retrieves an authenticated blob.

Required steps

1. Deploy the Blossom repair using the canonical deploy/ns-deploy-full.sh.
2. Restart blossom.service and verify it is active.
3. Run the safe functional probe from [P0][blossom] Add functional upload test matrix (auth, hash, MIME, size, storage) #103 against blossom.nostr.ltd:
   • Upload a disposable blob with a test identity.
   • Retrieve it.
   • Clean it up.
4. Capture the probe result in the deployment log without secrets.
5. If no safe automated credential is available, mark upload verification as manual and document the manual procedure.

Acceptance criteria

• Production blossom.nostr.ltd accepts an authenticated upload.
• The uploaded blob is retrievable through the public hostname.
• Deployment log shows upload verification status separately from process status.
• No secrets in the log.

Dependencies

• Blocked by [P0][blossom] Repair production storage.rules so authenticated uploads are accepted #102 and [P0][blossom] Add functional upload test matrix (auth, hash, MIME, size, storage) #103.

Source

Migrated from docs/pending-work-plan.md §2.4 + §10 step 3.

[psam21]

Dependency map:

• Blocked by [P0][blossom] Repair production storage.rules so authenticated uploads are accepted #102 (rule repair must exist).
• Blocked by [P0][blossom] Add functional upload test matrix (auth, hash, MIME, size, storage) #103 (upload test matrix must exist).