feat: S3 client compatibility — virtual-hosted style, CORS, presigned multi-method, ListMultipartUploads, edge case fixes

- Virtual-hosted bucket detection from Host header (extractS3BucketFromHost)
- S3 CORS headers + OPTIONS preflight + x-amz-id-2/HostId everywhere
- Presigned GET/PUT/HEAD/DELETE via centralized auth (no GET-only restriction)
- ListMultipartUploads with DB/xml helpers
- UploadPart partNumber range validation (1-10000)
- CompleteMultipartUpload ETag matching and ascending order validation
- DeleteObjects quiet mode support
- CopyObject URL-decode and conditional if-match/if-none-match
- encoding-type=url support in ListObjects V1/V2 XML
- Safe range-based prefix matching (replaces SQL LIKE)
- STREAMING-AWS4-HMAC-SHA256-PAYLOAD → 501 NotImplemented
- Traefik wildcard HostRegex for virtual-hosted style
- S3_VHOST_DOMAINS config env var

src/env.ts

@@ -20,6 +20,7 @@ interface AppConfig {
   s3SecretKey: string;
   s3DefaultRegion: string;
   proxyS3Get: boolean;
+  s3VhostDomains: string[];
 }
 
 const requiredEnv = {
@@ -50,6 +51,14 @@ const parseTokens = (value: string | undefined): string[] =>
     .map((t) => t.trim())
     .filter((t) => t !== '');
 
+const parseDomains = (value: string | undefined): string[] =>
+  parseTokens(value).map((domain) =>
+    domain
+      .replace(/^https?:\/\//, '')
+      .split('/')[0]
+      .toLowerCase(),
+  );
+
 const maskSecret = (value: string): string => {
   if (!value) return '';
   if (value.length <= 10) return '***';
@@ -80,6 +89,9 @@ export const config: AppConfig = {
   s3SecretKey: process.env.S3_SECRET_KEY || '',
   s3DefaultRegion: process.env.S3_DEFAULT_REGION || 'us-east-1',
   proxyS3Get: process.env.PROXY_S3_GET !== 'false',
+  s3VhostDomains: parseDomains(
+    process.env.S3_VHOST_DOMAINS || 'upload.asepharyana.my.id,upload.asepharyana.web.id',
+  ),
 };
 
 logger.info('Environment variables loaded', {