The backend S3 client now resolves credentials from user-configurable environment variables

docs/s3-audio-input.md

@@ -20,6 +20,8 @@ Not implemented:
 
 - `storage.s3.bucket` must be set when S3 audio input is used.
 - `storage.s3.root_prefix` defaults to `dnd`.
+- `storage.s3.access_key_id_env` defaults to `OBJECT_STORAGE_KEY_ID`.
+- `storage.s3.secret_access_key_env` defaults to `OBJECT_STORAGE_KEY`.
 - `spool.root` defaults to `/var/spool/narratio`.
 
 `session.yml`:

docs/storage-backends.md

@@ -30,6 +30,8 @@ Construction:
   - region
   - endpoint
   - force_path_style
+  - access_key_id_env
+  - secret_access_key_env
 
 ## Key Invariant
 
@@ -42,7 +44,9 @@ S3 session/run key builders remain separate and continue to live outside backend
 ## Security Boundary
 
 - do not store AWS credentials in Narratio config
-- AWS credentials are resolved through standard AWS SDK credential chains
+- Narratio first checks configured env-var names (`access_key_id_env`, `secret_access_key_env`);
+  when both are present and non-empty, it uses static credentials from those values
+- when either configured credential value is missing, Narratio falls back to the standard AWS SDK credential chain
 - AWS SDK-specific types remain isolated to the storage adapter package
 
 ## Testing