feat(storage): wire OSS object storage for cloud deployment

继续用户已授权的两档云端部署开发：实现真实 OSS ObjectStore 与运行时配置装配。

范围：
- ali-oss SDK + ECS RAM 角色自动刷新 / 显式环境凭据。
- putOnce/get/head、SHA-256/Content-MD5、命名空间隔离、准确错误映射。
- 启动和写入前拒绝私有/非版本桶条件不满足的配置，禁止云配置失败回退 FS。
- 保持 PhysicalPurgePort 独立，提供 OSS 清除适配且不把 delete 加入业务 ObjectStore。
- 单元和实际 SDK→隔离 HTTP 服务测试；真实 OSS lane 缺凭据明确失败，不伪报云验收。

验收先写测试，保持现有 FS 开发模式；kernel.module.ts 只替换装配表达式并减少导入行，不增加超限文件体积。完整文件链路和部署总 SLA 仍在后续验收。

用户直接交办、接续已合并 #3415；按 ad-hoc SOP 交付独立 PR，不修改 feature 状态。

Start with the existing FS development pattern and kernel.module.ts, then trace the storage assembly and the tests requested in the issue. Add unit coverage and an SDK-to-isolated-HTTP-service test for the OSS adapter, plus a real OSS lane that fails explicitly when credentials are missing. Done means the stated configuration checks, object operations, hashing, isolation, error mapping, and separate purge adapter are covered without FS fallback.

Written by the indexing model from the issue text.