ML-173: replace aws-sdk with aws4 + built-in fetch

Replace @aws-sdk/client-s3 (~150 transitive deps, ~14MB) with aws4
(0 transitive deps, ~40KB) and Node.js built-in fetch+crypto for
S3 ListObjectsV2 against Hetzner Object Storage.

- New s3-client.ts: SigV4 signing via aws4, regex-based XML parsing
  with namespace tolerance, pagination support, 5 error categories
- 29 unit tests (node:test, zero-dependency) covering signing,
  parsing, entities, missing fields, pagination, abort, errors
- Settlement guard for double done(null) on abort
- XML entity decoding and regex metacharacter escaping
- Dependency surface: 150 packages → 1 (aws4, single-file, auditable)

.pi/extensions/s3-browser/aws4.d.ts

@@ -0,0 +1,30 @@
+declare module "aws4" {
+  interface Aws4Request {
+    host?: string;
+    path?: string;
+    method?: string;
+    headers?: Record<string, string>;
+    service?: string;
+    region?: string;
+    body?: string;
+    signQuery?: boolean;
+  }
+
+  interface Aws4Credentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+  }
+
+  function sign(
+    request: Aws4Request,
+    credentials: Aws4Credentials,
+  ): Aws4Request & {
+    host: string;
+    path: string;
+    headers: Record<string, string>;
+  };
+
+  const aws4: { sign: typeof sign };
+  export default aws4;
+}