Explain S3 credential and project lifecycle behavior

[gabrielpaues]

Summary

• New section in storage/getting-started.md explaining that S3 credentials are issued per user while the S3 account itself is bound to the project — covering the practical consequences for user removal, re-adding users, and SSO sign-in disablement vs. underlying account removal.
• Adds a "Personal vs. shared credentials" subsection recommending personal credentials over a shared service-account key pair, with a short rotation-blast-radius rationale (for-cause termination vs. amicable departure).
• Rewords the "Minimum required info for S3 access" paragraph to match the per-user model (was previously stating keys "are not personal" and that they should be shared within a project).
• Removes the now-obsolete admonition about a future update offering personal S3 credentials within a project — that is the current behavior.

Follow-up to #109, which added the openstack CLI flow for issuing S3 credentials.

Test plan

• mkdocs serve locally and verify the new section renders under "Get S3 credentials" with correct heading hierarchy.
• Confirm the in-page link from "Minimum required info for S3 access" resolves to #s3-credentials-users-and-project-lifecycle.
• Spot-check that the rest of the page (URL list, client configuration links, bucket naming) is unaffected.