feat: add configurable S3 object storage

docs/api.md

@@ -678,6 +678,41 @@ Authorization: Bearer <admin_token>
 Content-Type: application/json
 ```
 
+### 11.6 S3 存储端点
+
+```http
+GET /admin/storage/endpoints
+Authorization: Bearer <admin_token>
+```
+
+```http
+POST /admin/storage/endpoints
+Authorization: Bearer <admin_token>
+Content-Type: application/json
+
+{
+  "name": "119 高带宽 S3",
+  "internal_endpoint": "http://10.70.0.2:3900",
+  "public_endpoint": "https://files.example.com",
+  "bucket": "imageforge-results",
+  "region": "garage",
+  "access_key": "<access-key>",
+  "secret_key": "<secret-key>",
+  "force_path_style": true,
+  "presign_ttl_seconds": 300
+}
+```
+
+```http
+PUT /admin/storage/endpoints/{endpoint_id}
+POST /admin/storage/endpoints/{endpoint_id}/test
+POST /admin/storage/endpoints/{endpoint_id}/activate
+DELETE /admin/storage/endpoints/{endpoint_id}
+Authorization: Bearer <admin_token>
+```
+
+凭据加密保存且不通过 API 回传。测试接口执行 Bucket 检查、内部临时对象读写删和公网预签名下载；激活接口会再次测试并原子切换活动端点。活动端点不能直接编辑或删除。
+
 ---
 
 ## 12. WebSocket（网站任务进度）