[L4] BYOC S3 client pool: new streamhouse-storage/src/byoc.rs module

[gbram1]

Part of an AI-generated stack — level 4 of 5.
Depends on: Level 3. Merges into: stack/pr-3/L03-auth-refactor-rename-clerkauth-oidcjwksa.

Goal

Add the ByocS3ClientPool that assumes customer IAM roles via STS and wires it into AppState and the unified server.

Risk

medium — Adds aws-config and aws-sdk-sts as new heavy dependencies and introduces a network call (STS AssumeRole) in the server startup path when BYOC_ENABLED=true; the pool is opt-in but adds compile-time weight to all builds.

Rationale

Depends on L3 because unified-server.rs now initializes both oidc_auth (L3) and byoc_s3 (this level), and AppState gains the byoc_s3 field which compiles only after L3's oidc_auth rename is in place. Reviewers should check: the STS credential refresh window (5 min early), that ByocS3ClientPool::from_env returns None safely when BYOC_ENABLED is unset, and that the new AWS SDK deps don't introduce duplicate TLS stacks. fly.toml deletion is included here as cleanup tied to the cloud-deployment refactor. Cargo.lock also lives here as the lock file update is dominated by the new AWS SDK deps.

Files (8)

• crates/streamhouse-storage/src/byoc.rs
• crates/streamhouse-storage/src/lib.rs
• crates/streamhouse-storage/Cargo.toml
• crates/streamhouse-server/src/bin/unified-server.rs
• Cargo.toml
• Cargo.lock
• docs/deployment.md
• fly.toml