feat(storage,deploy): delad S3/mock-lagring, SSM .env-sync, Gemini readyz

- @app/storage med MockStorage + AwsStorage delas mellan API och worker

- Workerns readUrl() ger presignerad S3-URL i aws-läge (fixar mock-s3 404)

- sync-env-from-ssm.py hämtar /cibello/prod/* och skriver .env; first-deploy.sh kör det i prod

- /readyz returnerar 503 om app.aamos.healthCheck() misslyckas

- docs/SECRETS.md med rotations- och SSM-regler

apps/worker/src/processors/scans.ts

@@ -27,7 +27,7 @@ export async function processScanJob(ctx: WorkerContext, scanJobId: string): Pro
     .set({ status: "running", attempts: job.attempts + 1, updatedAt: new Date() })
     .where(eq(schema.scanJobs.id, scanJobId));
 
-  const imageUrls = job.s3Keys.map((k) => ctx.readUrl(k));
+  const imageUrls = await Promise.all(job.s3Keys.map((k) => ctx.readUrl(k)));
   const localeContext = await getLocaleContext(ctx, job.userId);
   const consentFlags = await loadConsentFlags(ctx, job.userId);