Verify inbound SigV4 presigned URLs (query-string auth) in resolve_identity

## Summary

Add support for verifying **inbound SigV4 presigned URLs** (signature carried in the query string) in the auth layer. Today `resolve_identity` only authenticates requests whose SigV4 material is in the `Authorization` header; presigned requests are treated as anonymous.

This unblocks presigned-URL support in the Source Cooperative data proxy — see downstream issue: source-cooperative/data.source.coop#136. The proxy wants to issue standard AWS SigV4 presigned GET URLs (generated with STS temp creds) that browser data-viewers can fetch directly, while the proxy still streams the bytes.

## Current behavior (the gap)

`crates/core/src/auth/identity.rs::resolve_identity`:
- Returns `ResolvedIdentity::Anonymous` whenever there is no `Authorization` header.
- Reads the session token (`x-amz-security-token`) and payload hash (`x-amz-content-sha256`) from **headers**.

For a presigned URL, all SigV4 material is in the **query string** (`X-Amz-Algorithm`, `X-Amz-Credential`, `X-Amz-Date`, `X-Amz-Expires`, `X-Amz-SignedHeaders`, `X-Amz-Security-Token`, `X-Amz-Signature`), and the canonical request is constructed differently. So presigned requests currently fail to authenticate.

Much of the machinery already exists and is reusable: `crates/core/src/auth/sigv4.rs::verify_sigv4_signature` already takes a `query_string` and `canonicalize_query_string` already sorts it; the `SigV4Auth` struct, signing-key derivation, and `constant_time_eq` can all be shared.

## Proposed change

In `crates/core/src/auth/sigv4.rs` + `crates/core/src/auth/identity.rs`:

1. **Detect presigned requests** in `resolve_identity` — if the query contains `X-Amz-Algorithm=AWS4-HMAC-SHA256` (or `X-Amz-Signature`), take a presigned branch *before* the `Anonymous` early-return.
2. **Parse SigV4 from the query** — new `parse_sigv4_presigned(query)` producing a `SigV4Auth` (reuse the existing credential-scope split) plus `expires` and the security token. Pull `X-Amz-Credential`, `X-Amz-SignedHeaders`, `X-Amz-Signature`, `X-Amz-Date`, `X-Amz-Expires`, `X-Amz-Security-Token`.
3. **Presigned canonical-request variant** — either parameterize `verify_sigv4_signature` or add a sibling:
- Canonical query = all query params **except `X-Amz-Signature`**, sorted/encoded (strip it, then `canonicalize_query_string`).
- Payload hash = the literal string `UNSIGNED-PAYLOAD`.
- `string_to_sign` date comes from the `X-Amz-Date` **query** param (not the `x-amz-date` header).
- Reuse the existing signing-key derivation and `constant_time_eq`.
4. **Enforce expiry** — reject when `X-Amz-Date + X-Amz-Expires < now` (small clock-skew allowance).
5. **Session token** — resolve `X-Amz-Security-Token` through the existing `credential_resolver` (`TemporaryCredentialResolver`), keep the access-key↔token match check, and return the same `ResolvedIdentity::Authenticated`. Everything downstream (authorize → presign-backend → stream) is unchanged.

## Tests

Add AWS SigV4 **presigned** test vectors alongside the existing header-auth vectors in `crates/core/src/auth/tests.rs`:
- A known presigned canonical request → expected signature (positive).
- Tampered query param → signature mismatch.
- `X-Amz-Date + X-Amz-Expires` in the past → expired/denied.
- With `X-Amz-Security-Token` resolved via a stub `TemporaryCredentialResolver` → `Authenticated`.

## Release

Cut a minor release so downstream consumers (the data proxy, currently on 0.4.0) can bump.

---
*Filed alongside source-cooperative/data.source.coop#136.*