fix(security): sanitize unmapped errors + stop example stream leaks

[gmoon]

Two hardening fixes from a security review of the S3-fronting proxy. Scoped to the two highest-value findings; validated locally (lint + type-check + build + 49/49 unit tests green).

1. Error-detail leakage (MEDIUM) — src/s3-gateway.ts

mapError wrapped only NoSuchKey/NoSuchBucket→404, AccessDenied→403, InvalidRange→416 and rethrew everything else unchanged. Unmapped S3ServiceExceptions carry sensitive detail:

• PermanentRedirect → discloses the bucket's real region/endpoint
• SlowDown/InternalError → carry $metadata.requestId and often the bucket name

…and the examples render err.message straight into the response body, so a client can force these conditions and harvest AWS internals.

Fix: unmapped errors are wrapped in a generic S3ProxyError(500); the original is preserved on cause for server-side logging only. Applies to both fetch() and healthCheck() — the latter is client-reachable via the examples' /health route, so narrowing to fetch() alone would leave /health leaking.

Important

Behavior change: send()/init()/fetch() now reject with a sanitized S3ProxyError(500) for previously-unclassified errors instead of the raw error. Inspect err.cause for the original. The known mappings (404/403/416) are unchanged. Unit tests updated to assert the new contract (sanitized message + preserved cause).

2. Stream/socket leak in examples (MEDIUM) — examples/{http,express-basic,fastify-basic}.ts

.pipe(res) does not destroy the S3 source stream when the client disconnects mid-transfer, leaking the underlying S3 socket under abusive clients (open a range request, disconnect, repeat). Switched to stream.pipeline(), which destroys the source on client abort or write error. (hono-basic.ts already handles this via Readable.toWeb cancellation.)

Deliberately not included (tracked separately)

• Add buildspec.yml for integration with AWS CodeBuild #2 keyPrefix confinement — design decision (the whole bucket is currently served)
• Save mocha test results to a file #4 nosniff/content-type control — stored-XSS surface if the bucket accepts untrusted uploads
• Add javascript linting with eslint #5 403/404 enumeration — IAM-policy hardening
• Create build artifact for use in CodePipeline #6 init() double-signaling (emit + throw)

Test plan

• npm run lint / type-check / build / test:unit (49/49) green locally
• CI green
• Confirm the error-contract change is acceptable for downstream consumers