feat(backlog): presign resumable fallback, login rate-limit and e2e private HLS

[SlavaKuntsov]

Closes #19
Closes #20
Closes #21

Summary

Backlog phase — 3 issues: brute-force protection for login, Content-Range resumable fallback for presigned upload, and e2e coverage for presign + private HLS.

• auth services/auth/src/core/limiter.py:1 — slowapi 5/min/IP on POST /api/v1/auth/login with redis (redis:7-alpine in compose) fallback to memory; 429 after limit (services/auth/src/routers/auth.py:60, services/auth/src/main.py:11).
• upload services/upload/internal/handler/resumable.go:1 — GET /api/v1/videos/{id}/resumable offset + PUT /resumable with Content-Range: bytes start-end/total (308 until complete, 200 when done, 416 on mismatch) via StatObjectSize/GetObject/PutObject; gateway proxies /resumable (services/gateway/cmd/server/main.go:121); frontend frontend/src/lib/api.ts:158 adds getResumableOffset/uploadResumable with fallback in uploadVideo.
• infra/e2e scripts/e2e.sh:262 — adds steps 8 presign POST /presign→PUT presigned→POST /complete→poll ready→HLS, 9 private PATCH visibility private→403 without token→200 with hls-token + Cache-Control private, 10 resumable 308→200 incl. 50% split resume.
• fix services/upload/internal/storage/minio.go:60 — generate presigned URL for public host (MINIO_PUBLIC_ENDPOINT) without breaking SigV4 (tmp client Region us-east-1, BucketLookupPath); services/gateway/cmd/server/main.go:121 — remove invalid wildcard */resumable causing chi panic.

Acceptance criteria

• P1 auth: add login rate-limit against brute-force #19 redis in compose, slowapi 5 req/min/IP on /auth/login, 429 after limit — curl 6× login →429, uv run pytest 12 passed
• P1 upload: add Content-Range resumable fallback #20 Content-Range handler for presign, PUT with Range resume — обрыв 50% → resume via GET /resumable + second PUT 200
• P1 infra: extend e2e for presign and private HLS #21 e2e tests presign→PUT→complete→ready→master.m3u8→ffprobe + private HLS 403/200 + old POST /upload — make e2e PASS

Verification

• make lint-go — 0 issues
• make lint-py — black/flake8/mypy pass
• make lint-front — next lint 0 warnings
• make test-go — upload handler 13 passed (incl. 4 resumable)
• make test-py — auth 12 passed (incl. rate-limit), transcoder 20 passed
• make up --build -d && make e2e — PASS (presign 200, private 403→200, resumable 308→200)

Remaining risks

• resumable append is Get+append+Put (O(n) re-upload per chunk) — ok for e2e 32KB sample, not for 5GB multi-chunk (accepted for backlog; MinIO multipart would be next step)
• limiter falls back to memory when redis unreachable locally (probe in limiter.py) — in compose redis is reachable, limits distributed