easterbrooka/mike: AWS S3 support and ECS-ready Dockerfile for the backend

easterbrooka reworked the storage layer so the backend can deploy against AWS S3 via an ECS task role, without touching R2 compatibility, then added a production-oriented Dockerfile for Fargate.

The storage client was rewritten to make endpoint and explicit credentials optional. When R2_ENDPOINT_URL is absent, the S3 SDK talks to native AWS. When R2_ACCESS_KEY_ID and R2_SECRET_ACCESS_KEY are absent, the SDK's default credential provider chain runs and picks up an ECS task role automatically. Region falls back through R2_REGION, then AWS_REGION, then "auto" for R2 compatibility. The storageEnabled check now returns true when either explicit credentials or a configured AWS region is present.

One thing to watch: any environment variable that sets AWS_REGION (even outside of ECS) will now flip storageEnabled to true. If your deployment previously short-circuited upload paths by leaving the R2 creds unset, verify that an ambient AWS_REGION won't change that behavior.

The Dockerfile is a two-stage build on node:22-bookworm-slim. The runtime image installs libreoffice-core, libreoffice-writer, fonts-liberation, and tini for signal handling. LibreOffice runs as the node user with a writable home directory for its profile. Build artifacts, dev dependencies, and secrets are excluded via .dockerignore. The env example was rewritten to document both deployment shapes with inline comments on when to omit credentials for task-role auth.