art-mockups: R2 gateway.
GET  /<key>     public read
PUT  /<key>     authenticated upload (Authorization: Bearer ...)
DELETE /<key>   authenticated delete