Vended storage credentials allowing scoped, time-limited keys for secure handover (backend flow)

[achtsnits]

in conjunction with EOEPCA/resource-discovery#27 (most effort tracked there for e2e)!

Vended storage credentials provide high security, full control, no permanent permissions, background see #51

goal:

• generate time-limited, scoped credentials
• scoping to grant access only to specific user or team
• still provide regular (familiar) use of these credentials to upload or download via common tooling

note: goal is to have the flow working end2end, UI support is separate topic

[achtsnits]

not completed during 25/Q3 -> will be moved to 25/Q4

[achtsnits]

not completed during 25/Q4 -> will be moved to 26/Q1