feat(storage,deploy): delad S3/mock-lagring, SSM .env-sync, Gemini readyz

- @app/storage med MockStorage + AwsStorage delas mellan API och worker

- Workerns readUrl() ger presignerad S3-URL i aws-läge (fixar mock-s3 404)

- sync-env-from-ssm.py hämtar /cibello/prod/* och skriver .env; first-deploy.sh kör det i prod

- /readyz returnerar 503 om app.aamos.healthCheck() misslyckas

- docs/SECRETS.md med rotations- och SSM-regler

apps/worker/package.json

@@ -25,12 +25,12 @@
     "@app/recipe-engine": "workspace:*",
     "@app/recommendation-engine": "workspace:*",
     "@app/shared-types": "workspace:*",
+    "@app/storage": "workspace:*",
     "@app/subscriptions": "workspace:*",
-    "@aws-sdk/client-s3": "^3.750.0",
+    "@aws-sdk/client-s3": "^3.1102.0",
     "bullmq": "^6.0.0",
     "dotenv": "^16.4.0",
     "drizzle-orm": "^0.45.0",
-    "@aws-sdk/client-s3": "^3.750.0",
     "ioredis": "^6.0.0",
     "pg": "^8.13.0"
   },
@@ -50,6 +50,7 @@
       "@app/recipe-engine",
       "@app/recommendation-engine",
       "@app/shared-types",
+      "@app/storage",
       "@app/subscriptions"
     ]
   }