docs(server): add S3 storage backend operator guide (#100)

[bigpuritz]

Closes #100.

The 1.0.0 release notes (PR #105) called out that the new S3-compatible storage backend ships; this PR is the operator-facing reference — what it is, all eight PLUGWERK_STORAGE_* env vars, four pasteable provider examples, and the migration playbooks (with the loud footgun warning).

Files changed

File	What
src/content/docs/server/storage.mdx (new)	Full operator guide (~250 lines)
server/configuration.mdx	Storage section shrinks from a four-line table to a one-paragraph pointer
server/deployment.mdx	One sentence after the Run-options table pointing at the storage page
astro.config.mjs	New "Storage backends" sidebar entry between Deployment and Configuration

What the new page covers

1. Choosing a backend — matrix mapping use cases (single-node Compose, multi-replica Kubernetes, cloud-managed serverless, DR, SaaS multi-tenant) to fs vs s3.
2. Filesystem (fs) — preserves the existing operator notes (default path, container-user permissions, key layout <namespace-uuid>:<plugin-id>:<version>:<extension>).
3. S3-compatible (s3) — full env-var table with the half-configured-credentials <Aside> (one set, one blank → rejected at startup) and the AWS DefaultCredentialsProvider fallback for the both-blank case.
4. Provider examples in <Tabs>: AWS S3 + IRSA / MinIO / Cloudflare R2 / Hetzner Object Storage. Every block highlights the three knobs that vary by provider (endpoint, region, path-style-access).
5. Migration between backends — opens with a prominent <Aside type="caution"> warning that flipping PLUGWERK_STORAGE_TYPE alone breaks every existing download with HTTP 404. Both directions documented (fs → s3 in <Tabs> for AWS CLI vs MinIO client; s3 → fs symmetric).
6. Verifying the migration — points at the live Admin → Storage Consistency UI (issue body's "Until #190 lands" wording is stale — the consistency check shipped in v1.0.0). CLI sanity-check fallback for environments without UI access.
7. What's not supported — explicit list (pre-signed direct uploads, GCS / Azure Blob native APIs, multi-bucket setups).

Sidebar position

Between Deployment and Configuration in the Server Administration group — mirrors the operator's mental flow: deploy → choose storage → configure → secure → operate.

Source verification

Every claim about the backend (key layout, half-configured-credentials rejection, fail-fast probe wording, the four supported providers, ConsistencyService availability) verified against ADR-0034 in the upstream repo at v1.0.0. Source files read for accuracy, not cited in the docs (per AGENTS.md no-internal-link rule). Internal-link grep returns 0 hits in the new content.

Acceptance criteria from #100

• Backend overview page lives at a discoverable URL under /server/ — /server/storage/
• Every PLUGWERK_STORAGE_* env var is in the configuration reference (including the half-configured-credentials gotcha and the path-style-access MinIO note)
• All four provider examples (AWS, MinIO, R2, Hetzner) are pasteable
• Migration page contains both directions with working CLI commands
• The "switching breaks existing downloads" footgun is in a callout box, not buried mid-paragraph
• Cross-links from the deployment + env-var reference pages

Departure from the issue text

• Single page instead of three (/server/storage/, .../configuration/, .../migration/). One operator-mental-model page is easier to read and maintain than three fragments. Other Server Administration topics are also single pages — consistency wins.
• "Until #190 lands" wording dropped — the consistency service shipped in v1.0.0; verifying-the-migration section points at the live UI instead.

Test plan

• npm run format clean
• npm run format:check clean
• npm run build clean (33 pages — +1 new storage page)
• AGENTS.md ADR/internal-PR grep clean in new content
• Storage page renders, all <Aside> and <Tabs> blocks build correctly
• Cross-links from /server/configuration/ and /server/deployment/ resolve to /server/storage/
• Reviewer: open /server/storage/, verify the migration <Aside type="caution"> is visually prominent (not buried), the four provider tabs all render with correct content, and the table reads cleanly on mobile
• Reviewer: verify the sidebar shows the new entry in the right slot of the Server Administration group
• Reviewer: spot-check one of the provider examples against the upstream .env.example to confirm wording matches

Out of scope

• Inline excerpt of the # --- S3-compatible storage --- section from .env.example via the envExampleSection helper from PR feat(docs): consume .env.example from plugwerk on every release (#101) #108 — depends on feat(docs): consume .env.example from plugwerk on every release (#101) #108 landing first; can be added as a small follow-up once that helper is in main. The page already points operators at the full .env.example reference at the bottom of the Configuration page.