A grant-backed file storage adapter, for presigned writes and reads #1742

Problem

#1606 settles that in hybrid the platform supplies the bucket and the data plane writes through a presigned grant. FileStoragePort has local, S3 and fsspec adapters, and none of them can write against a credential minted per operation.

Proposal

Add a grant-backed adapter under adapters/, selected by files_backend like the other three.

It writes to a presigned target it is given and reads through a grant minted per read. The durable reference stored on the record is the object key, never the grant, because a grant expires.

Obligations from #1603 that this adapter must not weaken: a grant covers one object key with a short deadline, never a prefix and never enumeration. A grant is never logged, never stored on the record, and never sent to a client. The last of those is what the streaming download in #1606 exists to protect.

The adapter builds its HTTP client once, like the other three build their backend client once, and does not construct one per request or per sweep.

Done when

• files_backend selects it and its required settings are validated at startup.
• A write and a read each use a grant scoped to one key.
• A test proves no grant reaches a log line, a stored row or a response body.