Add S3 CDN media readiness and cache health checks

src/modules/media/media.service.ts

@@ -53,6 +53,13 @@ export class MediaService {
     if (storageProvider === 's3' && !(storageHealth.isS3Configured ?? storageHealth.s3Configured)) {
       warnings.push('S3 provider selected but missing required env variables');
     }
+    if (storageProvider === 's3' && !storageHealth.storagePublicBaseUrlConfigured) {
+      warnings.push('STORAGE_PUBLIC_BASE_URL is not configured; media may be served from the storage endpoint instead of CDN');
+    }
+    const s3Health = storageHealth.s3 as Record<string, unknown> | undefined;
+    if (storageProvider === 's3' && s3Health?.reachable === false) {
+      warnings.push('S3 bucket is not reachable from the backend');
+    }
 
     const storageWritable =
       storageProvider !== 'local' || storageHealth.uploadPathWritable !== false;
@@ -80,6 +87,8 @@ export class MediaService {
         rangeRequests: true,
         immutableCacheSeconds: 31536000,
         hlsManifestCacheSeconds: 300,
+        s3ImmutableCacheControl: 'public, max-age=31536000, immutable',
+        s3HlsManifestCacheControl: 'public, max-age=300',
       },
       staticServing: {
         uploadsPublicPath: