feat(storage,g1): real-OSS support and G1 smoke — gate CLOSED

G1 (skipped at P1 for lack of credentials) executed 2026-09-21 against the
user-provided bucket live-album @ oss-cn-beijing:

Raw-SDK smoke (scripts/g1-oss-smoke.mjs, creds via runtime env only):
- HeadBucket / presign PUT direct upload / head byte+type verify /
  presign GET round-trip / copy staging→originals / idempotent replay /
  DeleteObject cleanup — all pass.
- S3-compat lifecycle query unsupported → console manual check remains the
  only open G1 sub-item (need: confirm no lifecycle rule hits photo-live/).

Adapter-level (production path, createStorageFromEnv → real OSS):
- presignPut+PUT 200, head verify, presignGet round-trip equal,
  copyIfAbsent idempotent (created:true→false, same etag),
  forbid-overwrite guard throws UPLOAD_VERIFY_FAILED — all pass.

Findings locked in:
- Addressing: OSS S3-compat requires virtual-host style with BASE endpoint
  (path-style → 403 signature mismatch). StoragePort adapter gains optional
  MinioStorageConfig.forcePathStyle + S3_FORCE_PATH_STYLE env (default true
  keeps local MinIO behavior); required-field validation fixed to string
  fields only (boolean false ≠ missing).
- .env.production.example-cn S3 section updated to the confirmed shape
  (beijing endpoint/region, virtual-host, bucket live-album).

Co-Authored-By: Claude Code <noreply@anthropic.com>

.env.production.example-cn

@@ -16,14 +16,17 @@ REDIS_URL_CN=redis://1Panel-redis-容器名或IP:6379
 # sync）读取；api-cn/worker 不读此键。
 DATABASE_URL_OV=mysql://photo_ov:CHANGE_ME@OV服务器IP:3306/photo_ov?connection_limit=10
 
-# ── 对象存储（真实阿里云 OSS 私有桶，P5/G1 冒烟脚本验证后填）──
+# ── 对象存储（真实阿里云 OSS 私有桶，G1 已于 2026-09-21 实测通过）──
 # endpoint 用「外网 Endpoint」（api-cn 服务器上传；worker 处理读原文件）。
 # bucket 私有读写：一切访问走 SigV4 现签 URL（SIGNED_URL_TTL_SECONDS）。
-S3_ENDPOINT=https://oss-cn-hangzhou.aliyuncs.com
-S3_REGION=cn-hangzhou
+# ⚠️ 寻址形态（G1 实测定案）：基础 endpoint（不含 bucket）+ virtual-host——
+#    即 S3_FORCE_PATH_STYLE=false。OSS 兼容口在 path-style 下 403 签名不匹配。
+S3_ENDPOINT=https://oss-cn-beijing.aliyuncs.com
+S3_REGION=oss-cn-beijing
 S3_ACCESS_KEY=CHANGE_ME_LTAI
 S3_SECRET_KEY=CHANGE_ME
-S3_BUCKET=photo-live-prod
+S3_BUCKET=live-album
+S3_FORCE_PATH_STYLE=false
 # 现签 GET（viewer 图片）/ PUT（上传）凭证有效期秒（uploads/support.ts）。
 SIGNED_URL_TTL_SECONDS=900
 # 单文件上传上限字节（uploads/support.ts；50MB 与契约 UPLOAD_MAX_BYTES 建议值一致）。