feat: direct-to-R2 Files uploads (client-sealed SPENC2) + chunked video dropzone + multi-file queue

For scale: payload bytes go browser → R2 → browser; the api handles keys,
authz and metadata only, so a cheap box can serve thousands of users.

- SPENC2 frame (browser-sealed, P-256 ECDH → HKDF wrap of a per-file CEK,
  10 MiG AES-GCM segments): storage.ts gains the reader (magic-branched
  getObject), presignPut/headObject, openDirectHeader; sealForDirect is the
  reference sealer for cross-implementation tests
- Files API: GET /files/direct/config, POST /files/direct/init (presigned
  PUT), POST /files/direct/complete (HEAD-gated commit), POST
  /files/:id/direct-download (presigned GET + CEK ticket)
- web: lib/direct-storage (WebCrypto seal/open), lib/files-direct (flows),
  dropzone rewritten with a multi-file sequential queue (per-file status,
  direct-first with server fallback), file download decrypts in-browser for
  direct objects (falls back to streaming)
- video dropzone wired to the chunked ingest API (>10 MiB → init/chunk/
  complete), fixing the Cloudflare ~100 MB body cap for large videos
- DIRECT_EC_PRIVATE_KEY (P-256, PKCS8 b64) wired through compose; cross-impl
  roundtrip tests prove web-seal ↔ server-open byte compatibility

apps/api/src/video/video.integration.test.ts

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { Pool, type PoolClient } from "pg";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { runMigrations } from "../db/migrate.js";
-import { sha256, keyForHash, type StorageService } from "../storage/storage.js";
+import { sha256, keyForHash, type StorageService, directStorageDisabled } from "../storage/storage.js";
 import { VideoService, type VideoServiceDependencies } from "./video.service.js";
 
 const dbAvailable = process.env.DATABASE_URL !== undefined;
@@ -45,6 +45,7 @@ describe.skipIf(!dbAvailable)("video library (live DB)", () => {
     },
     hasContent: async (hash, type) => objects.has(keyForHash(hash, type)),
     presign: async () => "unused",
+    ...directStorageDisabled(),
   };
 
   beforeAll(async () => {