fix(deletion): allow IRSA S3 credentials

[bradseiler]

Why

buzz-admin deletions runs inside bb-public relay pods, where S3 credentials are provided by the pod credential chain rather than static BUZZ_S3_ACCESS_KEY / BUZZ_S3_SECRET_KEY values. The deletion CLI was requiring those two env vars to be non-empty before constructing the shared media storage client, so it could not reach the existing default AWS credential chain.

What

• Treat missing/blank deletion S3 access key and secret key as an empty credential pair so MediaStorage::new can use Credentials::default().
• Keep the existing static-credential path unchanged when both values are non-empty.
• Keep deletion unit tests deterministic by covering only deletion env normalization for missing/blank pair, trimmed static pair, and partial/whitespace-partial outputs; shared media tests continue to own credential-pair enforcement.

Risk Assessment

Low and scoped to the operator-only community deletion CLI startup path. The shared media storage credential validation still owns static-vs-default credential selection and still rejects mixed partial credentials.

Testing

At committed head 0a86c2914b1f97caf4788a771048aa8d9d9d88ac with a clean worktree before and after (git rev-parse HEAD before/after matched):

• just fmt-check — passed.
• cargo test -p buzz-deletion — passed: 12 passed, 9 ignored.
• cargo test -p buzz-media — passed: 120 passed; static_creds_round_trip_against_minio remained ignored because it requires live MinIO.
• cargo test -p buzz-admin — passed: 1 passed.
• cargo clippy -p buzz-deletion --all-targets -- -D warnings — passed.
• Startup smoke at the same head: built buzz-admin, then ran target/debug/buzz-admin deletions drain with BUZZ_S3_ACCESS_KEY= and BUZZ_S3_SECRET_KEY=' ' plus AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY fallback credentials; command exited 0, proving startup transitions past deletion S3 key validation and exercises the shared default credential-chain branch using AWS env fallback credentials.
• git push origin HEAD:seiler/deletion-irsa-credentials — passed; pre-push hooks passed.

Not run: the full TESTING.md live-local relay workflow. Docker Desktop currently refuses CLI access on this machine with Sign in to continue using Docker Desktop. Membership in the [squareup] organization is required.

References

• Buzz channel: buzz://message?channel=9e4aabc6-414c-4978-aba7-b9f5228776de&id=177c5b8ad9e78a647f438ec7040d25f0c20a7c2b8678dd0e34768effe053f7f4

Generated with Codex