fix: minio-go must sign with Garage region ('garage', not AWS us-east-1)

app/src/media.go

@@ -47,7 +47,8 @@ func NewMediaClient() *MediaClient {
 		} else if strings.HasPrefix(addr, "https://") {
 			addr = strings.TrimPrefix(addr, "https://")
 		}
-		cl, err := minio.New(addr, mc.Key, mc.Secret, secure)
+		// Garage region is "garage" (not AWS us-east-1) — critical for SigV4 scope.
+		cl, err := minio.NewWithRegion(addr, mc.Key, mc.Secret, secure, "garage")
 		if err != nil {
 			mc.Err = err
 		} else {
@@ -80,6 +81,7 @@ func (c *MediaClient) Get(name string, w http.ResponseWriter) bool {
 	}
 	data, derr := io.ReadAll(obj)
 	if derr != nil {
+		log.Printf("media read %s: %v", name, derr)
 		http.Error(w, "media read error", http.StatusBadGateway)
 		return false
 	}