fix(s3): enforce UploadPartCopy source preconditions

[hsusul]

Summary

Fixes #1493.

UploadPartCopy accepted x-amz-copy-source-if-match, x-amz-copy-source-if-none-match, x-amz-copy-source-if-modified-since, and x-amz-copy-source-if-unmodified-since, then copied the source anyway. The handler dropped the headers, so the file backend wrote the part and the S3 backend never sent them to UploadPartCopy. A failed precondition also reserved multipart progress because that reservation happened before the copy.

This rejects a failed precondition before reserving progress, and forwards the headers on the S3 backend. CopyObject already enforced the same headers (#1406); this is the UploadPartCopy path.

Test plan

• src/storage/backend/file.test.ts — mismatched if-match returns 412 and does not write the part; a matching ETag copies the bytes
• src/storage/backend/s3/adapter.test.ts — preconditions are set on UploadPartCopyCommand
• src/storage/protocols/s3/s3-handler.test.ts — a failed if-match returns 412 before the progress transaction
• npm run lint
• npm run build
• Integration tests (npm run test:integration) require Docker and Postgres and were not run

[coveralls]

Coverage Report for CI Build 37885456270

Coverage decreased (-0.07%) to 84.873%

Details

• Coverage decreased (-0.07%) from the base build.
• Patch coverage: 4 uncovered changes across 1 file (30 of 34 lines covered, 88.24%).
• 17 coverage regressions across 1 file.

Uncovered Changes

File	Changed	Covered	%
src/storage/backend/s3/adapter.ts	7	3	42.86%
Total (4 files)	34	30	88.24%

Coverage Regressions

17 previously-covered lines in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
src/internal/http/agent.ts	17	32.56%

---

Coverage Stats

Relevant Lines:	14545
Covered Lines:	12793
Line Coverage:	87.95%
Relevant Branches:	8989
Covered Branches:	7181
Branch Coverage:	79.89%
Branches in Coverage %:	Yes
Coverage Strength:	784.45 hits per line

---

💛 - Coveralls