refactor(s3): replace hardcoded Tencent COS detection with extensible endpoint strategy pattern

[Copilot]

The S3Uploader had a hardcoded isTencentCos flag with brittle host.includes() checks, making it impossible to add new S3-compatible providers without modifying core upload logic.

Changes

• New interfaces (S3EndpointContext, S3EndpointResolution, S3EndpointStrategy) — all exported, forming the public contract for strategies
• TencentCosEndpointStrategy — extracts existing COS virtual-hosted style logic; also tightens the host match from includes('myqcloud.com') to endsWith('.myqcloud.com') (was susceptible to subdomain spoofing)
• DefaultS3EndpointStrategy — handles path-style vs. virtual-hosted detection for standard S3-compatible endpoints
• S3Uploader.registerStrategy() — fluent method to inject custom strategies ahead of the default fallback

// Plug in a new provider without touching S3Uploader internals
uploader.registerStrategy({
  matches: (host) => host.endsWith('.r2.cloudflarestorage.com'),
  resolve: (ctx) => ({
    requestHost: ctx.host,
    canonicalUri: `/${ctx.encodedObjectKey}`,
    baseUrl: ctx.endpoint,
  }),
})

The built-in strategies are pre-registered in priority order; DefaultS3EndpointStrategy is always last as the guaranteed fallback.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• download.redis.io
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node ./scripts/postinstall (dns block)
• fastdl.mongodb.org
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node ./postinstall.js (dns block)
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/mx-space-core/mx-space-core/apps/core/node_modules/.bin/../../../../node_modules/.pnpm/vitest@4.0.18_@opentelemetry+api@1.9.0_@types+node@25.0.10_happy-dom@20.5.0_jiti@2.6.1_terser@5.44.1_yaml@2.8.1/node_modules/vitest/vitest.mjs src/utils/s3.util.spec.ts (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.