feat: presigned-S3 download path for package blobs

[Androz2091]

Summary

Fixes the slow download path on /process/<id>/data (~17KB/s through API Gateway because of base64 round-trip + lack of streaming). Adds an additive /blob endpoint that returns a presigned S3 URL the client can fetch directly — bypassing API Gateway entirely.

How it works

Worker now dual-writes:

1. encrypted_data row in Postgres (legacy, unchanged)
2. Encrypted blob to a new private S3 bucket (dumpus-prod-package-data) under a deterministic key

API gets a new endpoint GET /process/<id>/blob that:

• Same auth as /data (Bearer UPN matches package_id)
• Returns {url, iv, ttl} JSON — url is a presigned S3 GET (5min default TTL), iv lets the client AES-decrypt locally
• Returns 409 if the row exists but no S3 blob has been uploaded yet → caller falls back to /data
• Returns 501 if PACKAGE_DATA_BUCKET env isn't set (local dev) → caller falls back to /data

/data is untouched. Migration is opt-in; frontend can switch when ready, then we deprecate /data in a follow-up.

Why safe

• Pure additive: no existing endpoint or schema changed
• Worker S3 upload failure is logged-and-swallowed (legacy DB write still happens)
• New IAM perms are minimal and resource-scoped (s3:PutObject on the bucket for worker, s3:GetObject on the bucket for API)
• VPC gateway endpoint for S3 means worker→S3 traffic doesn't transit fck-nat (free, and avoids putting big upload bytes through the t4g.nano)
• 90-day lifecycle on the bucket auto-cleans old blobs

Required frontend change (separate, not blocking)

Switch from GET /data (binary plaintext SQLite) to:

1. GET /blob → parse JSON
2. fetch(url) → encrypted bytes
3. AES-CBC decrypt with SHA256(UPN) as key, iv from the JSON

This actually implements the README's stated security model ("encryption key must always remain on the client side") — currently the server transiently decrypts.

Test plan

• Apply infra (gh workflow run infra.yml -f action=apply) — should add S3 bucket, IAM statements, env vars, S3 VPC endpoint; no changes to existing resources
• Push to main → deploy.yml ships new app code
• Submit a real package via POST /process and wait for PROCESSED
• GET /process/<id>/blob returns 200 + JSON with a working presigned URL
• curl -L $url downloads the encrypted blob fast (direct from S3)
• GET /process/<id>/data still works (legacy path)
• GET /process/demo/blob returns 409 (demo never goes through worker)