Discussion about private direct bucket data access

Some options:

- server data proxy. This isn't ideal because the server needs to proxy **all** data, so this puts a lot of egress load onto the server.
- signed urls: this isn't ideal for Zarr because normally Zarr is stored on S3, and you would have to sign every url independently
- STS tokens: AWS supports generating short term AWS credentials scoped to specific bucket operations and optionally a bucket prefix. We could use these tokens to generate signed AWS requests _from the client_, so the client would only need to make one server request, and the rest of the data could be fetched directly from object storage.
- I succeeded at getting obstore compiled to wasm (got a vibe coded prototype of this working, so it could work in theory)