fix(storage): use presigned URLs for private S3 buckets (7-day expiry)

app/storage.py

@@ -121,9 +121,12 @@ class S3Storage:
         k = _strip_prefix(key)
         if self.public_url:
             return f"{self.public_url}/{k}"
-        # fallback: path-style URL from endpoint + bucket
-        ep = self._client._endpoint.host
-        return f"{ep}/{self.bucket}/{k}"
+        # private bucket: generate presigned URL (7 days expiry)
+        return self._client.generate_presigned_url(
+            "get_object",
+            Params={"Bucket": self.bucket, "Key": k},
+            ExpiresIn=604800,
+        )
 
 
 # ── Helpers ────────────────────────────────────────────────────────