Storage buckets API

Grant: API_STORAGE. BYO also requires a Pro (or Platform) subscription unless that gate is disabled in a given environment.

`GET /v1/storage-buckets/oidc-setup`

Issuer, audience, subject, sample IAM trust policy. No body.

`POST /v1/storage-buckets`

Amazon S3:

{
  "name": "prod-layers",
  "provider": "S3",
  "auth_mode": "OIDC",
  "bucket_name": "my-bucket",
  "key_prefix": "amendable/",
  "role_arn": "arn:aws:iam::123456789012:role/amendable-byo-storage",
  "is_default": true
}

R2 / MinIO: auth_mode STATIC_KEYS, plus region, access_key_id, secret_access_key, and usually endpoint_url.

Status PENDING_VERIFICATION.

`POST /v1/storage-buckets/{id}/verify`

Canary Put/Head/Delete. 200 with status and last_validated_at, or 422 on provider failure (status becomes FAILED).

`GET /v1/storage-buckets`

`PUT /v1/storage-buckets/{id}`

OIDC region and endpoints stay platform-managed even if you send them.

`DELETE /v1/storage-buckets/{id}`

204, or 422 if repos still depend on it.

`GET /v1/storage-buckets/errors`

Query: limit, offset, storage_bucket_id.