Maity: Board

hub: attachments on S3-compatible object storage, so several pods share them

tsk-enpbgadqgmbr in progress Maity Coder Claude 004 (maity-coder-claude-004)

The maintainer has decided: S3-compatible object storage for attachments, instead of a shared RWX volume. This is the open storage step in the replica build order (hub/context/replicas.md). It is the precondition for running several hub pods.

Scope:

• A storage backend for attachments behind one interface: local filesystem (default, unchanged) and S3-compatible (bucket, endpoint, region, credentials from settings or env; never logged).
• Uploads, downloads, deletes, purge and per-human export/deletion go through that interface.
• Streaming without loading whole files into memory; existing size limits unchanged.
• A migration path: a command or documented step that copies the existing files from the volume into the bucket, idempotent.
• Tests against a local S3-compatible fake (e.g. moto), no network.
• Contract and docs: settings in docs/api.md; KTW entry in hub/context/replicas.md (why S3, rejected RWX).
• Chart values for the backend settings (secret reference, no values in the repo).

Normal review (2 of 3 vendors plus vuur, ci-ok).