storage: R2 + GCS + Azure drivers (S-10 from #1873 / #1887 split-out)

[glennmichael123]

Split out from #1887 — the per-tenant scoping piece (S-11) shipped in `a150b8971`. The three driver implementations are tracked here because each blocks on a different prerequisite.

R2 (Cloudflare)

R2 is S3-API-compatible. Implementation is mostly a thin extension of `S3StorageAdapter` with:

• Custom endpoint: `https://.r2.cloudflarestorage.com`
• `region: 'auto'` (R2 has no real regions)
• Custom-domain support for `publicUrl()` (R2-mapped domain)
• R2-specific signed URL rules (some headers differ from S3 standard)

Blocker: ts-cloud's `S3Client(region?: string, profile?: string)` constructor doesn't accept a custom endpoint. Either:

1. Upstream fix: file ts-cloud to add `endpoint?: string` to the constructor — minimal change, unlocks R2 plus any other S3-compatible store (MinIO, DigitalOcean Spaces, Backblaze B2)
2. Local fix: implement R2 as a fully-standalone SigV4 client without ts-cloud (~150 lines of HMAC signing)

Option 1 is cleaner.

GCS (Google Cloud Storage)

Needs `@google-cloud/storage` as a peer dep. Different API entirely from S3:

• Auth: service-account credentials JSON OR `GOOGLE_APPLICATION_CREDENTIALS` env var OR explicit `projectId + keyFilename`
• Signed URLs: V4 signing via the SDK's `getSignedUrl()`
• Resumable uploads (similar to S3 multipart but different protocol)
• Custom-domain public URLs need bucket-level config

Blocker: peer dep install + the testing story (Google's official SDK is heavy; the local-dev story is awkward without real GCS access).

Azure Blob Storage

Needs `@azure/storage-blob` as a peer dep. Auth options:

• Connection string
• Account name + account key
• `DefaultAzureCredential` (managed identity / env-based)

SAS tokens for signed URLs; `BlockBlobClient` for upload (with multipart-equivalent for >256MB).

Blocker: peer dep install + Azure's SDK has its own auth-flow surprises (storage account types, soft-delete defaults, RBAC permissions).

Scope for the follow-up

Each driver is independently shippable. Phasing suggestion:

1. R2 first — pair with the ts-cloud endpoint fix; smallest delta from the existing S3 driver
2. GCS second — most common ask after S3
3. Azure last — smallest user base; can land standalone

All three plug into the existing `ScopedStorageAdapter` from `a150b8971` without further changes — multi-tenant scoping works the moment they ship.

Acceptance

• R2: extends `S3StorageAdapter` with custom-endpoint config; `publicUrl()` honors custom domain; ts-cloud upstream lands or local SigV4 client implemented
• GCS: full `StorageAdapter` implementation including streaming + signed URLs; peer-dep config in `package.json`
• Azure: full `StorageAdapter` implementation including streaming + SAS-signed URLs; peer-dep config in `package.json`
• Per-driver setup docs (auth + bucket/container creation)
• Test coverage per driver (basic CRUD + signed URL minimum)

Referenced from #1887.

[glennmichael123]

Upstream issue filed: stacksjs/ts-cloud#116 — S3Client custom endpoint config.

Once that lands, R2 is ~30 lines extending S3StorageAdapter with R2-specific defaults (region: 'auto', endpoint template, custom-domain publicUrl). MinIO / DigitalOcean Spaces / Backblaze B2 / Wasabi all also become possible from the same upstream fix.

GCS + Azure remain blocked on their respective SDK installs (@google-cloud/storage / @azure/storage-blob); separate from the endpoint work.

[glennmichael123]

Paused per leadership direction (2026-05-26). No driver impls (R2 / GCS / Azure) will land here until this is unpaused.

Status of the underlying pieces:

• The Stacks-side per-tenant scoping wrapper (ScopedStorageAdapter) is already shipped via storage: R2 / GCS / Azure drivers + per-tenant prefix scoping (S-10, S-11 from #1873) #1887 Phase A — not affected by the hold.
• Upstream tracker S3Client: accept custom endpoint config (unblocks R2 / MinIO / DigitalOcean Spaces / Backblaze B2 in stacksjs/stacks#1896) ts-cloud#116 (custom S3 endpoint config — the prerequisite for R2) stays open; it's a feature request on a different repo and not in scope of this pause.
• The streaming pipeline, presigned POST, cross-disk copy/move, etc. from the storage audit (storage: path-traversal in presigned URLs, stubbed visibility, no streaming/multipart, missing R2/GCS/Azure #1873) are all already merged.

When the hold is lifted, the work needed here is:

1. R2 driver — extends S3StorageAdapter with R2 endpoint defaults (region: 'auto', endpoint: https://<account-id>.r2.cloudflarestorage.com), gated on ts-cloud#116 landing
2. GCS driver — needs @google-cloud/storage SDK install + adapter implementing the StorageAdapter contract
3. Azure driver — needs @azure/storage-blob SDK install + adapter