test: expand unit test coverage to all S3 edge cases; fix stale tests

Add comprehensive unit tests and repair stale tests that referenced the
old (pre-refactor) src/utils/* layout which no longer exists:

- s3-range: expand to 25 cases (suffix, clamping, malformed, zero-size,
  invalid totals, content-range formatting)
- s3-object-stream: rewrite against the real interfaces/s3 module; add
  multi-part ordering, ranges spanning parts, S3/CORS headers, fetch-error
  propagation
- s3-helpers-edge (new): compress heuristics, virtual-host bucket parsing,
  S3 route detection, client-IP/trustProxy, S3 response headers
- s3-auth-edge (new): verifyBodyHash, isS3Request, canonical-query-string
  encoding/sorting
- chunked-storage: rewrite against the real ChunkedStorage class (was
  importing deleted src/utils/chunked-storage) — chunk split, hashing,
  compression, size-limit guards, forwarding
- zip: fix stale import + add path-traversal/duplicate sanitization,
  locateZipEntry, empty-name fallback
- s3-docker-registry: fix stale src/config import; correct the rate-limit
  test to assert S3 routes INTENTIONALLY bypass rate limiting
- temp-stream (new): streamToTemp hashing, MD5, signature bytes, empty and
  oversized streams
- package.json: add the S3/unit files to test and test:s3 scripts

All new unit tests pass when run per-file (the project's documented mode to
avoid cross-file mock pollution). s3-sdk.test.ts (live E2E against a running
server) is deliberately excluded from test:s3.

test/s3-docker-registry.test.ts

@@ -257,16 +257,22 @@ describe('S3 Object Stream Timeouts', () => {
 
 describe('S3 Route Rate Limiting', () => {
   /**
-   * Verifies that S3 routes in the route table are rate-limited.
+   * S3 routes are intentionally NOT wrapped in withRateLimit: Docker registry
+   * clients retry on 5xx but abort on 4xx, so a 429 would break blob pushes.
+   * This asserts that the S3 dispatch path bypasses the rate limiter.
    */
-  it('applies rate limiting to S3 root routes', async () => {
+  it('dispatches S3 requests without rate-limiting (direct path)', async () => {
     const source = await Bun.file('src/interfaces/http/routes/index.ts').text();
 
-    // The route definitions for S3 should use withRateLimit
-    expect(source).toContain('handleS3WithRateLimit');
+    // The S3 dispatcher intentionally bypasses the rate limiter.
+    expect(source).toContain('handleS3Direct');
+    expect(source).toContain('return handleS3Request(req, getS3RouteBucket(req));');
 
-    // The rate limit function should be imported
-    expect(source).toContain('withRateLimit');
+    // Non-S3 self-service routes ARE rate-limited (multipart-free /api/upload
+    // and file redirect/info). This proves withRateLimit is applied to the
+    // web routes while S3 dispatch stays direct.
+    expect(source).toContain('withRateLimit(handleUpload)');
+    expect(source).toContain('withRateLimit(handleFileRedirect)');
   });
 });
 
@@ -390,7 +396,7 @@ describe('S3 File Size Limits', () => {
    * Verifies that the S3 config has proper size limits for Docker usage.
    */
   it('has appropriate size limits for Docker layer blobs', async () => {
-    const { config } = await import('../src/config/index.ts');
+    const { config } = await import('../src/env');
 
     // Docker layers can be multiple GB
     expect(config.maxRequestBodyBytes).toBeGreaterThanOrEqual(500 * 1024 * 1024);