feat: add S3/SigV4 proxy handler for MinIO JWT auth

- New s3/sigv4.go: JWT → SigV4 converter proxy
  * Validates JWT via JWKS
  * Checks s3:read/s3:write permissions
  * Forwards requests to MinIO with SigV4 signature
- Router: Add /v1/s3/* routing to S3Handler
- Gateway main: Initialize S3Handler with MinIO credentials
- Proxy: Add JWTValidator() getter for s3 handler
- Env vars: MINIO_ENDPOINT, MINIO_ACCESS_KEY, MINIO_SECRET_KEY

cmd/gateway/main.go

@@ -11,6 +11,7 @@ import (
 
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/proxy"
+	"forgejo.riotpiao.com/rock/homelab-frontend/internal/s3"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/server"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/serviceadapter"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/temporal"
@@ -77,9 +78,35 @@ func main() {
 	log.Printf("%d service adapters loaded", registry.Count())
 	dispatcher := serviceadapter.NewDispatcher(registry)
 
+	// Create S3/SigV4 handler for MinIO access via JWT
+	var s3Handler http.Handler
+	minioEndpoint := os.Getenv("MINIO_ENDPOINT")
+	if minioEndpoint == "" {
+		minioEndpoint = "https://minio-api.riotpiao.com"
+	}
+	minioAccessKey := os.Getenv("MINIO_ACCESS_KEY")
+	minioSecretKey := os.Getenv("MINIO_SECRET_KEY")
+	if minioAccessKey != "" && minioSecretKey != "" {
+		s3h, err := s3.NewSigV4Handler(minioEndpoint, minioAccessKey, minioSecretKey, upstreamHandler.(*proxy.Handler).JWTValidator())
+		if err != nil {
+			log.Printf("warning: failed to create S3 handler: %v", err)
+			s3Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				http.Error(w, "S3 handler not configured", http.StatusServiceUnavailable)
+			})
+		} else {
+			s3Handler = s3h
+			log.Printf("S3/SigV4 handler initialized for MinIO at %s", minioEndpoint)
+		}
+	} else {
+		log.Printf("S3/SigV4 handler disabled: MINIO_ACCESS_KEY or MINIO_SECRET_KEY not set")
+		s3Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			http.Error(w, "S3 handler not configured", http.StatusServiceUnavailable)
+		})
+	}
+
 	// Create router that handles health endpoints, X-Service (ServiceAdapter) routing,
-	// temporal endpoints, and passes others to upstream handler
-	router := server.NewRouter(healthChecker, dispatcher, temporalHandler, upstreamHandler)
+	// Temporal workflow endpoints, S3/SigV4 endpoints, and passes others to upstream handler
+	router := server.NewRouter(healthChecker, dispatcher, temporalHandler, s3Handler, upstreamHandler)
 
 	// Wrap router with tracing middleware
 	tracedRouter := tracing.Middleware(router)