nextlevelbuilder#1166 (#90)
* refactor(media): introduce Backend interface, keep Store as façade
Splits internal/media into:
- backend.go: Backend interface (Save / Open / LocalPath / Delete) and a
 shared ErrNotFound sentinel.
- fs_backend.go: FSBackend, the historical filesystem implementation
 that used to live in store.go. Same key shape, same rename-or-copy
 semantics; no behaviour change.
- store.go: Store is now a thin façade over a Backend. NewStore still
 returns an FS-backed store, so every existing caller — gateway wiring,
 agent loop, http handlers, tests — keeps working without changes.
 New code that wants context-aware access can grab Store.Backend()
 directly.
ExtFromMime stays on Store so both backends agree on the extension that
ends up in the object key.
This commit is intentionally behaviour-preserving. S3Backend, the config
factory, and the bypass-site fixes land in follow-up commits on this
branch.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(media): add S3Backend + env-driven factory
S3Backend persists media objects under {prefix}/{sessionHash}/{id}.{ext}
plus a tiny manifest object at {prefix}/_manifests/{id} that maps the
bare media ID back to its full key. The manifest lets LocalPath / Open
resolve an ID in two GetObjects (manifest + payload) without scanning
the bucket, which would not scale.
Highlights:
- Credentials come from the default AWS SDK chain only (IAM role on
 EC2 / ECS / EKS, env vars in dev). No static-key field on Config to
 avoid copy-pasted secrets in env files.
- manager.NewUploader does multipart with 10MB parts / concurrency=3,
 same posture as internal/backup.
- LocalPath downloads into a process-local cache dir (default
 os.TempDir()/goclaw-media-cache), atomic-renames a sibling tempfile
 into place so a partial fetch never gets surfaced as a cache hit.
- Delete lists the session prefix, batch-deletes payloads in groups of
 1000, then drops the corresponding manifests (best-effort — a
 leftover manifest just wastes a few bytes).
- Endpoint override is plumbed through for MinIO / R2 / DO Spaces.
internal/media/config.go introduces Config + LoadConfigFromEnv +
NewBackend + NewStoreFromConfig so cmd/ wiring stays a one-liner.
Default backend is "fs", default baseDir is whatever the caller passes
in — existing deployments see zero behaviour change.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(media): wire env-driven backend selection + FSBackend tests
cmd/gateway_managed.go switches from media.NewStore(workspace+\"/.media\")
to media.NewStoreFromConfig(LoadConfigFromEnv(...)). FS remains the
default — operators with no GOCLAW_MEDIA_* env see byte-for-byte the
same behaviour they had before — but flipping a single env var now
moves session media to S3 without touching code.
internal/media/fs_backend_test.go covers the refactor:
- Save→LocalPath→Open→Delete round trip, including the source-file
 consumption contract.
- ExtFromMime taking precedence over the source's own extension.
- LocalPath returning ErrNotFound (errors.Is-matchable) for stale IDs.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>