feat: per-table storage middleware — replace global mutations with typed per-table hooks

[pyramation]

Summary

Replaces the global requestUploadUrl / requestBulkUploadUrls / deleteFile mutations with per-table PostGraphile hooks, keyed by @storageBuckets and @storageFiles smart tags.

graphile-presigned-url-plugin:

• plugin.ts: Rewritten — requestUploadUrl and requestBulkUploadUrls added as fields on any type tagged @storageBuckets; delete middleware wraps delete* mutations on @storageFiles tables with S3 cleanup
• storage-module-cache.ts: New loadAllStorageModules() + resolveStorageConfigFromCodec() helpers — matches codec's schema+table name against cached storage modules (no ownerId/probing needed)
• download-url-field.ts: Uses codec-based resolution for entity-scoped files
• s3-signer.ts: Added deleteS3Object()
• Global mutations removed entirely — no backward compatibility wrappers

upload-client:

• Updated to query bucket by key via collection query, then call bucket.requestUploadUrl(...) field
• New bucketQueryField option for custom bucket collection field name

Tests:

• Upload integration test uses buckets(condition: { key: $key }) { nodes { ... } } (not bucketByKey — disabled by NoUniqueLookupPreset)
• Schema snapshots deleted and regenerated (global mutations removed from introspection)

Design: Each storage module (app-level, org-scoped, room-scoped, etc.) gets its own typed GraphQL API. No scope resolution needed — PostGraphile already knows which table each type comes from. The plugin detects smart tags at schema build time and augments the appropriate types.

Depends on: constructive-db PR #1037 (adds @storageBuckets smart tag via new append_smart_tags helper)

Review & Testing Checklist for Human

• Verify requestUploadUrl field appears on bucket types in GraphiQL (on the Bucket type, not as a root mutation)
• Test upload flow end-to-end: query bucket → call requestUploadUrl field → PUT to presigned URL
• Verify delete middleware fires: delete a file via generated deleteAppFile mutation and check S3 object cleanup
• Confirm downloadUrl still works for entity-scoped files (not just app-level)
• Check that old global mutations (requestUploadUrl, requestBulkUploadUrls) are gone from the schema

Notes

• The upload-client now takes a bucketQueryField option (defaults to 'buckets') for apps with custom bucket table names
• Delete middleware reads the file row BEFORE PostGraphile's delete executes (to get the S3 key), then does S3 cleanup after
• The AFTER DELETE trigger in constructive-db is still the async safety net for S3 GC"

Link to Devin session: https://app.devin.ai/sessions/ffa3ed8652fc412f976accbdc229c88d
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring