feat(metaschema-modules): storage_module.region; storage coordinates are DB-only

[pyramation]

Summary

Adds region text NULL to metaschema_modules_public.storage_module, in place in the existing table definition. The comment on the connection columns now describes them as the only source of storage coordinates, where they used to be "NULL = use global env/plugin defaults". sql/metaschema-modules--0.47.0.{sql,bundle.tar.gz} were regenerated with pgpm package. The only SQL change is the new column.

The same edit is in constructive-db's vendored mirror (pgpm-modules/metaschema-modules). This repo is the one npm publishes from: the @pgpm/metaschema-modules@0.47.0 gitHead is 65abdcd9 (v0.47.0) here.

Spec: constructive-io/constructive-planning#2161 (context #2136).

Single source of truth

metaschema_modules_public.storage_module holds endpoint, provider, region (new column, added in place) and public_url_prefix. Buckets get their physical identity from each bucket row's physical_name.

• The deployment's object store is the platform database's scope = 'platform', key = 'default' row.
• On every other plane, NULL inherits that row's value. This is coalesce(sm.x, psm.x) inside the query that is already cached, so there's no extra DB read.
• platform_config and platform_secrets hold no storage coordinates.
• The only env is STORAGE_ACCESS_KEY_ID / STORAGE_SECRET_ACCESS_KEY. Each storage consumer requires them and fails fast with an error naming both. There are no aliases and no fallbacks.
• Presigned URLs are signed for the DB endpoint, so the DB has to hold a client-reachable host.

Merge / publish order (4 PRs)

1. constructive-io/pgpm-modules devin/1791334000-storage-region: merge, then publish @pgpm/metaschema-modules (the next lerna release after 0.47.0). This repo is what npm publishes. constructive-db's pgpm-modules/ is a vendored mirror (docs/architecture/npm-publication-sources.md).
2. constructive-io/constructive devin/1791334000-storage-db-driven: bump the root pgpm.json fixture @pgpm/metaschema-modules to that release (re-run pnpm fixtures:install). The storage suites need storage_module.region, so they only pass after that bump. Merge, then publish the graphile-*, @constructive-io/* and pgpm packages.
3. constructive-io/constructive-db devin/1791334000-storage-db-driven (targets main): CI doesn't depend on any publish. Before deploying, bump @constructive-io/graphql-server / graphile-settings to the step-2 releases (the published ones before that still read CDN_*). Relabel the mirror to the step-1 version.
4. constructive-io/constructive-cloud devin/1791334000-storage-db-driven: apply only together with a release promotion that pins images built from steps 2 and 3. The bootstrap writes storage_module.region, and pods no longer get CDN_*/BUCKET_*.

Link to Devin session: https://app.devin.ai/sessions/f3fd69925240491c9d7507d3b97aa5cb
Open in Devin Desktop: https://app.devin.ai/desktop/session/f3fd69925240491c9d7507d3b97aa5cb?variant=devin
Requested by: @pyramation

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. 🟠 1 high

💬 Inline comments (1)

• 🟠 Add region via new change, not in-place edit — table.sql:78

🧹 Nitpicks (1) — 🟢 1 low

• 🟢 Verify script does not assert region column (table.sql:5) — The change adds region text NULL to storage_module (deploy/schemas/metaschema_modules_public/tables/storage_module/table.sql:78) but the paired verify script only checks assert_table('metaschema_modules_public.storage_module'::regclass) (verify/schemas/metaschema_modules_public/tables/storage_module/table.sql:5) and never proves the new column's existence or type, contrary to AGENTS.md's requirement that verify prove intended state.

---

This PR extends the storage_module table definition in metaschema-modules with a new nullable region text column, adds rustfs to the allowed provider list, and refreshes the connection-semantics documentation comments. The regenerated sql/metaschema-modules--0.47.0.sql bundle matches the deploy source, but the new column is folded into an existing deployed change rather than introduced as a new plan entry, so already-deployed databases will not receive it.

Files	Change
deploy/.../tables/storage_module/table.sql	Adds region text NULL, the rustfs provider value, and expanded comments on credential/endpoint requirements
sql/metaschema-modules--0.47.0.sql	Regenerated bundle mirroring the deploy change
verify/.../tables/storage_module/table.sql	Unchanged; does not yet assert the new column

The high-severity finding concerns migration mechanics (in-place edit of a deployed change vs. a new pgpm.plan change with matching verify/revert); the low-severity finding asks the verify script to assert the region column's existence and type.

_{Reviewed commit: 8cc1bee}

[tenki-reviewer]

Adds a nullable region column and rustfs provider to the storage_module table, but edits an already-shipped deploy change in place instead of adding a new change.

Key findings

• 🟠 Add region via new change, not in-place edit — table.sql:78