feat(storage): apply CORS policy on organization S3 buckets at creation (#642)

[fe51]

Closes #642

What and Why

Apply a CORS policy on organization S3 buckets at creation, so the platform's
"download all (ZIP)" and "download all + bounding boxes" buttons work.

These buttons use native fetch() on presigned S3 URLs, which is subject to CORS —
unlike the single-image download, which uses <a download> and isn't. With no CORS
config on the buckets, the browser blocked those cross-origin fetch()es.

How

S3Service.create_bucket now applies a CORS rule right after creating the bucket:

• AllowedMethods: GET, HEAD (browser only reads images; uploads are server-side)
• AllowedOrigins: from the new S3_CORS_ORIGINS setting
• AllowedHeaders: *
• ExposeHeaders: Content-Length, Content-Type
• MaxAgeSeconds: 3000

Config / default

S3_CORS_ORIGINS is a comma-separated list of allowed frontend origins.
Deployments must set it to the real frontend URLs (prod/preprod). The default
http://localhost:5173 is a fail-closed fallback for local dev only — deliberately
not *, so a forgotten env var breaks visibly instead of silently allowing any origin.

Existing buckets

This only applies to newly created buckets. I'll backfill the existing prod/preprod
buckets separately with a one-off script after merge.

Validation

• Verified against real cloud provider object storage service: put_bucket_cors is honored and served
  (confirmed the Access-Control-Allow-Origin header is returned and the frontend
  download works end-to-end).
• Added a LocalStack test asserting the CORS policy is set on the bucket at creation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.75%. Comparing base (729a870) to head (b709c88).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #674   +/-   ##
=======================================
  Coverage   93.74%   93.75%           
=======================================
  Files          59       59           
  Lines        3147     3152    +5     
=======================================
+ Hits         2950     2955    +5     
  Misses        197      197           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fe51]

@MateoLostanlen all good to review ! test we randomly broken on a part of the code non related to the PR (triangulation). re-running it solve the failing test..

[MateoLostanlen]

LGTM. Have you already prepared the backfill script for the existing buckets?