[P0][blossom] Add functional upload test matrix (auth, hash, MIME, size, storage)

[psam21]

Migrated from docs/pending-work-plan.md §2.4.

Problem

The repository currently has only a port-level health check for Blossom. A reachable HTTP 200 is insufficient evidence that uploads work. We need a testable upload matrix that exercises the real failure modes.

Required test coverage

At minimum, the matrix must cover:

1. Accepted authenticated upload (happy path)
2. Missing authentication → rejected
3. Wrong auth event type → rejected
4. Missing SHA-256 x tag binding → rejected
5. Mismatched SHA-256 (declared vs. computed) → rejected
6. Oversized payload (>10 MB) → rejected
7. Rejected MIME type → rejected
8. Duplicate blob behavior (idempotency / dedup)
9. Retrieval of the accepted blob
10. Deletion authorization (owner can delete, non-owner cannot)

Where the tests must run

• Local test storage backend by default.
• Staging S3 bucket only when explicitly configured (via env var / secret).
• Never against production S3 or production data.

Deployment verification step

A safe functional probe must:

• Use a generated disposable blob (random bytes, small size).
• Use a test identity (not a real user's private key).
• Upload, verify retrieval, then clean up the blob.
• Mark upload verification as manual if no safe automated credential is available, rather than reporting the service fully verified.

Acceptance criteria

• All 10 matrix cases covered by automated tests.
• Tests run in CI without requiring production credentials.
• Deployment script performs the safe functional probe and reports upload status separately from process status.

Dependencies

• Depends on [P0][blossom] Repair production storage.rules so authenticated uploads are accepted #102 (rules must exist before tests can assert accept/reject behavior).
• Blocks [P0][blossom] Deploy Blossom repair and verify public authenticated upload + retrieval #104 (deployment verification depends on the matrix).

Source

Migrated from docs/pending-work-plan.md §2.4.

[psam21]

Dependency map:

• Blocked by [P0][blossom] Investigate Blossom upload failure: empty storage.rules rejecting all uploads #101 (test assertions depend on understanding the actual failure mode).
• Blocks [P0][blossom] Deploy Blossom repair and verify public authenticated upload + retrieval #104 (deployment verification depends on the matrix).
• Blocks [P0][deploy] Tighten deployment safeguards (clean checkout, atomic rollback, separate status reporting) #108 (deployment safeguards depend on the upload smoke test).
• Blocks [P1][validation] Define and execute the full validation matrix from a clean checkout #112 (validation matrix references this issue).