Improve GCS S3-Compatible Attachment Support

Check before submitting

• I searched existing issues and did not find a duplicate

What problem would this solve?

Improve GCS S3-Compatible Attachment Support

Memos 0.30.0 with Google Cloud Storage via the S3/XML API hit two GCS compatibility issues:

• PutObject failed with SignatureDoesNotMatch.
• After upload worked, browser-facing presigned GCS attachment URLs still failed with SignatureDoesNotMatch.

What would you like to happen?

The working GCS setup required:

endpoint=https://storage.googleapis.com
region=<bucket-region>
pathStyle=true
requestChecksumCalculation=when_required
responseChecksumValidation=when_required
signedPayload=true
stripAcceptEncodingBeforeSigning=true
directPresignedAttachmentURL=false

Changes that made it work:

• Use path-style S3 requests for GCS.
• Force signed SHA256 payloads instead of unsigned payload signing.
• Strip Accept-Encoding before SigV4 signing.
• Disable SDK request/response checksums except when required.
• Store attachment refs as /file/attachments/{uid}/{filename}, not direct presigned GCS URLs.
• Stream S3/GCS attachments through the Memos file server with server-side GetObject.
• Repair existing S3 attachment refs back to local Memos file URLs instead of refreshing them to presigned URLs.

Suggested upstream shape:

type S3Config struct {
    Endpoint string
    Region string
    Bucket string
    UsePathStyle bool

    ForceSignedPayload bool
    StripAcceptEncodingBeforeSigning bool
    RequestChecksumCalculation string
    ResponseChecksumValidation string

    DirectPresignedURL bool
}

This would let GCS and other strict S3-compatible providers work without downstream patches.

Additional context

No response