feat(ingest): S3 / S3-compatible object store source for bulk ingest, with watch mode #264

Owner goal: first-class ingestion of images from API endpoints and bulk from the backend, and the same from an S3 bucket in the cloud, including watching a bucket for new files. Today the bulk runner (#229) supports only a folder or a manifest of local paths under OP_SOURCE_ROOT; there is no S3 code. Design questions to settle first (plan file, then build): (1) Source kind 's3' (bucket + prefix, region/endpoint, S3-compatible such as MinIO for local tests) in src/services/curation/bulk_ingest/source.py; the pipeline reads local paths today, so decide between streaming object bytes straight into the ingest pipeline (no temp files; best for throughput and for the GPU/CPU decode routing from #217) and staging to a local cache; either way originals must stay servable for review/crops (presigned URL or proxy) and the stored image reference must identify bucket/key/version-or-etag. (2) Listing at scale: ListObjectsV2 paging with a checkpoint (StartAfter / last-modified), parallel prefix listing, and ranged/concurrent GETs with bounded in-flight bytes (reuse the decoded-megabyte admission gate). (3) Watch mode: periodic poll with a durable checkpoint per project/source first (simple, resumable, works with any S3-compatible store); S3 Event Notifications to SQS as a later option; schedule via the existing job mechanism so a daily/hourly batch is just a recurring run. (4) Idempotency: content hash ledger already skips stored images; use ETag/version to avoid re-downloading. (5) Security: the API has no authentication and is loopback-only by default (SECURITY.md): cloud credentials widen the blast radius, so read them from the environment / instance role / a mounted secret file, never from the request or the tree, scope them to read-only on the configured bucket/prefix allow-list, fail closed on an unconfigured bucket. (6) Surfaces: same runner behind the CLI (scripts/curation/bulk_ingest.py), the /ingest/bulk route and the Cropwright panel; progress and failures as today; contracts regenerated. (7) Tests: MinIO in an isolated compose project for the live tests, offline unit tests with a fake client; public data only. Sequence: after the decode/ingest speed work (#217, #226, #248) so it is built on the final pipeline.