ML-173: replace aws-sdk with aws4 + built-in fetch

Replace @aws-sdk/client-s3 (~150 transitive deps, ~14MB) with aws4
(0 transitive deps, ~40KB) and Node.js built-in fetch+crypto for
S3 ListObjectsV2 against Hetzner Object Storage.

- New s3-client.ts: SigV4 signing via aws4, regex-based XML parsing
  with namespace tolerance, pagination support, 5 error categories
- 29 unit tests (node:test, zero-dependency) covering signing,
  parsing, entities, missing fields, pagination, abort, errors
- Settlement guard for double done(null) on abort
- XML entity decoding and regex metacharacter escaping
- Dependency surface: 150 packages → 1 (aws4, single-file, auditable)

.pi/extensions/s3-browser/package.json

@@ -1,7 +1,11 @@
 {
   "name": "s3-browser",
   "private": true,
+  "type": "module",
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.787.0"
+    "aws4": "^1.13.2"
+  },
+  "scripts": {
+    "test": "node --experimental-strip-types --test s3-client.test.ts"
   }
 }