feat(storage,deploy): delad S3/mock-lagring, SSM .env-sync, Gemini readyz

- @app/storage med MockStorage + AwsStorage delas mellan API och worker

- Workerns readUrl() ger presignerad S3-URL i aws-läge (fixar mock-s3 404)

- sync-env-from-ssm.py hämtar /cibello/prod/* och skriver .env; first-deploy.sh kör det i prod

- /readyz returnerar 503 om app.aamos.healthCheck() misslyckas

- docs/SECRETS.md med rotations- och SSM-regler

pnpm-lock.yaml

@@ -93,6 +93,9 @@ importers:
       '@app/shared-types':
         specifier: workspace:*
         version: link:../../packages/shared-types
+      '@app/storage':
+        specifier: workspace:*
+        version: link:../../packages/storage
       '@app/subscriptions':
         specifier: workspace:*
         version: link:../../packages/subscriptions
@@ -293,11 +296,14 @@ importers:
       '@app/shared-types':
         specifier: workspace:*
         version: link:../../packages/shared-types
+      '@app/storage':
+        specifier: workspace:*
+        version: link:../../packages/storage
       '@app/subscriptions':
         specifier: workspace:*
         version: link:../../packages/subscriptions
       '@aws-sdk/client-s3':
-        specifier: ^3.750.0
+        specifier: ^3.1102.0
         version: 3.1102.0
       bullmq:
         specifier: ^6.0.0
@@ -466,6 +472,15 @@ importers:
 
   packages/shared-types: {}
 
+  packages/storage:
+    dependencies:
+      '@aws-sdk/client-s3':
+        specifier: ^3.1102.0
+        version: 3.1102.0
+      '@aws-sdk/s3-request-presigner':
+        specifier: ^3.1102.0
+        version: 3.1102.0
+
   packages/subscriptions:
     dependencies:
       '@app/shared-types':