feat: add S3/SigV4 proxy handler for MinIO JWT auth

- New s3/sigv4.go: JWT → SigV4 converter proxy
  * Validates JWT via JWKS
  * Checks s3:read/s3:write permissions
  * Forwards requests to MinIO with SigV4 signature
- Router: Add /v1/s3/* routing to S3Handler
- Gateway main: Initialize S3Handler with MinIO credentials
- Proxy: Add JWTValidator() getter for s3 handler
- Env vars: MINIO_ENDPOINT, MINIO_ACCESS_KEY, MINIO_SECRET_KEY

internal/proxy/proxy.go

@@ -458,6 +458,12 @@ func (h *Handler) handleModelsEndpoint(w http.ResponseWriter, r *http.Request) {
 	json.NewEncoder(w).Encode(response)
 }
 
+// JWTValidator returns the JWT validator for this handler.
+// Used by other handlers (e.g., S3/SigV4 proxy) to validate tokens.
+func (h *Handler) JWTValidator() *auth.Validator {
+	return h.jwtValidator
+}
+
 // Close closes all underlying transports, releasing their connection pools.
 func (h *Handler) Close() error {
 	for _, transport := range h.transports {