feat: /media route — app proxies Garage S3 bucket via AWS SigV4 (scoped read key)

app/src/main.go

@@ -37,8 +37,25 @@ func main() {
 	log.Printf("loaded %d articles across %d subjects", len(c.Articles), len(c.Subjects))
 
 	s := NewSite(c)
+	// media proxy config (Garage S3)
+	s.Media = &S3MediaClient{
+		Endpoint: os.Getenv("KONTRA_S3_ENDPOINT"),
+		Bucket:   os.Getenv("KONTRA_S3_BUCKET"),
+		Key:      os.Getenv("KONTRA_S3_KEY"),
+		Secret:   os.Getenv("KONTRA_S3_SECRET"),
+		Client:   http.Client{},
+	}
+	if s.Media.Endpoint == "" {
+		s.Media.Endpoint = "http://127.0.0.1:3900"
+	}
+	if s.Media.Bucket == "" {
+		s.Media.Bucket = "kontra-day"
+	}
 
 	// Routes — register specific paths BEFORE the catch-all.
+	http.HandleFunc("/media/{path...}", func(w http.ResponseWriter, r *http.Request) {
+		s.media(w, r, r.PathValue("path"))
+	})
 	http.HandleFunc("/subjects/{slug}", func(w http.ResponseWriter, r *http.Request) {
 		s.subject(w, r, r.PathValue("slug"))
 	})