Ingest surfaces: S3 source, webhook/cron/watch triggers, gRPC decision (plan) #271

Plan: docs/design/ingest_surfaces_plan.md (PR #269, docs only; the file lives on main once that PR merges). Covers #264 (S3 source with watch mode) and #263 (gRPC ingest channel, only if it wins by measurement), built on the bulk runner of #229.

Goal: every way of getting images in ends in one pipeline (ingest_batch): HTTP API requests (exists), bulk from a folder or manifest (exists), S3 and S3-compatible stores (new), triggers (new), gRPC (decided by measurement).

Owner decisions already made: no API authentication for now (local use), credentials only from the environment, an instance role or a mounted secret file, fail closed on an unconfigured bucket or prefix; webhook and cron and poll-watch are all in scope; built on the final pipeline (decode routing, coalesced writer, bulk concurrency 16, project isolation, lock rule and OCC, content-hash ledger); live tests on MinIO in an isolated compose project, offline tests on a fake client, public data only.

Work slices, in order (each ends with passing tests; contracts regenerated in the same commit):

1. S3 source and checkpointed watcher: object store seam, fetch with bounded in-flight bytes, objects route, per-source durable queue keyed by (key, etag), paged and prefix-parallel resumable scan, folder watcher, source registry and run-now, one-shot bulk start for a bucket, CLI.
2. Webhook receiver: S3/MinIO event shape validation, idempotent by bucket/key/etag, fast 202.
3. Schedules and dispatcher: cron, poll interval, webhook drains, backoff, one acting worker per project.
4. Cropwright: sources panel (status, triggers, last run, failures, run now, retry), served blocked_message and poll_after_s.
5. gRPC decision: transport-only measurement with an Amdahl bound first, written decision rule, prototype only if it passes (see plan section 8).
6. One live end-to-end check (MinIO -> webhook -> bulk run -> OpenSearch -> Cropwright, full-page screenshots at desktop and 430 px), persist stage share recorded, teardown proven.

The plan also lists the file map, interfaces, route shapes, edge cases, the test plan and the traps found while sketching an implementation (section 12).