fix(file-service): restore configured S3 uploads

[devin-ai-integration]

Summary

• Symptom / blast radius: All file uploads built from the affected file-service image return 500 storage_error after S3 rejects writes to a nonexistent bucket.
• Root cause (config/env): The production image sets FILE_UPLOAD_ALWAYS_FAIL=true, overriding the safe application default and redirecting every upload away from S3_BUCKET.
• Fix: Remove the image-level override so upload_file uses the configured S3 bucket, and add a regression guard that rejects truthy Dockerfile defaults across supported ENV forms.
• Verification: Rebuilt the image and recreated file-service with FILE_UPLOAD_ALWAYS_FAIL fully unset so Compose could not mask the image default. bright circle.jpg uploaded successfully through the web UI, returned 201, rendered from otterworks-files, downloaded with matching bytes, and existed in LocalStack. cargo test, cargo fmt --check, and cargo clippy --all-targets -- -D warnings pass. Screen recording.

Independent incident run; compare with #261, which addresses the same outage and uses the same hardened Dockerfile guard scope.

Link to Devin session: https://app.devin.ai/sessions/291490b52e1d4ef4acc47eaac7e35e1c

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.