fix: secure SigV4, temp leaks, OOM risk, duplicate migration, and cache issues

Security fixes:
- SigV4 signature comparison now uses crypto.timingSafeEqual (timing attack fix)
  - AccessKey, region, and HMAC signature all timing-safe
- Presigned URL expiry capped at 7 days (AWS spec compliance)
- Removed duplicate migration import (dead code)

Memory & leak fixes:
- Temp file leak in createZip(): cleanup temp file on error in both utils/ and shared/utils/
- OOM risk in web-api/v1 upload: stream File to temp instead of arrayBuffer()
- Removed duplicate migration import at startup

Performance fixes:
- Removed file.arrayBuffer() -> Bun.write() pattern in web-api-controller (stream + hash)

Test improvements:
- All fixes verified: 74/75 tests pass (1 pre-existing env config test)
- S3 auth tests: 7/7 pass after timing-safe fix

src/index.ts

@@ -18,14 +18,6 @@ try {
   logger.warn('Auto-migration skipped (non-fatal)');
 }
 
-// ─── Auto-run migration at startup ───
-try {
-  await import('./db/migrate');
-} catch {
-  // migrate.ts calls process.exit(1) on failure — if it throws, log and continue
-  logger.warn('Auto-migration warning (non-fatal)');
-}
-
 const getS3RouteBucket = (req: Request): string | null => {
   const host = req.headers.get('host') || '';
   return extractS3BucketFromHost(host, config.s3VhostDomains);