Implemented a centralized secret-backed object-store helper

docs/internal/storage.md

@@ -6,6 +6,7 @@ Document Narratio's remote storage backend contracts and implementations under `
 ## Inputs and outputs
 Inputs:
 - Resolved storage config (`pipeline.storage.*`).
+- Already-loaded environment variables for configured S3 credentials.
 - Bucket-relative object keys and local file paths from app/stage orchestration.
 
 Outputs:
@@ -22,6 +23,7 @@ Does not own:
 - Session/run prefix semantics.
 - Archive commit order semantics.
 - Manifest updates.
+- Filesystem secret loading from `pipeline.secrets.env_dir`.
 
 ## Config fields used
 - `pipeline.storage.backend`
@@ -55,6 +57,7 @@ Implementations:
 ## Failure behavior
 - `NewObjectStoreFromConfig` fails when no remote backend is configured or required S3 config is missing.
 - `S3Backend` constructor fails when required bucket is missing or AWS client setup fails.
+- App command orchestration loads configured filesystem secrets before calling the object-store factory.
 - CRUD operations return contextual errors (including not-found behavior via `Exists`).
 - Key normalization is applied before operations (`\\` to `/`, leading slash trimmed).
 - Remote session loading uses `List` to find the exact `session.yml` key and `Download` to materialize it to a local temp file.