feat(news-portal): add Cloudflare R2 image delivery readiness checks #635

Depends on: #631, #632, #633, #634

Context

Full-online R2-only news portal mode must fail safely when Cloudflare R2 is not configured correctly. Image delivery must use a trusted R2 public base URL or custom domain, and local filesystem/image paths must not be used.

Objective

Add configuration validation, production readiness checks, and security readiness gates for Cloudflare R2-only news image delivery.

Scope

Add or extend readiness/config checks for:

R2_NEWS_IMAGE_CUSTOM_DOMAIN
R2_NEWS_IMAGE_PUBLIC_BASE_URL
R2_NEWS_IMAGE_BUCKET
R2_NEWS_IMAGE_ALLOWED_MIME_TYPES
R2_NEWS_IMAGE_MAX_BYTES
R2_NEWS_IMAGE_REQUIRE_CHECKSUM
R2_NEWS_IMAGE_PRESIGNED_PUT_EXPIRES_SECONDS
LOCAL_FILE_UPLOADS_ENABLED
LOCAL_MEDIA_STORAGE_ENABLED
FILE_STORAGE_DRIVER
NEWS_IMAGE_STORAGE_POLICY

Failure conditions:

• Full-online news portal enabled but R2 config is incomplete.
• NEWS_IMAGE_STORAGE_POLICY != r2_only.
• FILE_STORAGE_DRIVER != cloudflare_r2.
• LOCAL_FILE_UPLOADS_ENABLED=true.
• LOCAL_MEDIA_STORAGE_ENABLED=true.
• R2 public base URL is empty, localhost, or unsafe.
• Production uses r2.dev instead of a custom domain, unless explicitly allowed for non-production only.
• Allowed MIME types include unsafe/non-image types.
• Presigned upload expiry is too long.
• Required checksum validation is disabled in production.

Out of scope

• Implementing the upload API.
• Creating actual R2 buckets.
• Managing Cloudflare DNS through API.
• Local storage fallback.

Acceptance criteria

• bun run config:validate fails on incomplete R2 news image configuration.
• bun run security:readiness fails when local media storage is enabled for full-online R2-only mode.
• bun run production:preflight fails when production uses unsafe public base URL or missing custom domain.
• .env.example documents required variables.
• Error messages explain what variable must be fixed.
• Non-production/dev mode can be documented separately without weakening production defaults.
• Tests cover valid config, missing R2 keys, local storage accidentally enabled, unsafe public URL, invalid MIME list, and overly long presigned expiry.
• bun run check passes.

Security notes

• Readiness checks must not print secret values.
• Never log R2_SECRET_ACCESS_KEY.
• Never output full presigned URLs in readiness logs.
• Keep production default strict: no local fallback and no unsafe public URL.