feat(bucket-tenants): add persisted bucket-scoped tenant credentials with bucket export and import APIs

readme.hints.md

@@ -14,6 +14,9 @@
 - Runtime bucket summaries and storage stats via the Rust bridge (no S3 list scans)
 - Cluster health introspection via the Rust bridge (node membership, local drive probes, quorum, healing state)
 - Runtime credential listing and atomic replacement via the Rust bridge
+- Runtime credentials persist under `{storage}/.smartstorage/credentials.json`
+- Bucket tenant APIs provision scoped per-bucket credentials and enforce the scope before bucket-policy/default-auth authorization
+- Per-bucket export/import uses `smartstorage.bucket.v1` JSON with object payloads encoded per object
 - Cluster identity and topology snapshots persist under `{storage}/.smartstorage/cluster/`
 - S3-side operational endpoints are available at `/-/live`, `/-/ready`, `/-/health`, and `/-/metrics`
 - Runtime credential listing returns access-key metadata only; secrets are write-only
@@ -44,6 +47,13 @@
 | `start` | `{ config: ISmartStorageConfig }` | Init storage + HTTP server |
 | `stop` | `{}` | Graceful shutdown |
 | `createBucket` | `{ name: string }` | Create bucket directory |
+| `createBucketTenant` | `{ bucketName, accessKeyId, secretAccessKey, region? }` | Create bucket and scoped persisted credential |
+| `deleteBucketTenant` | `{ bucketName, accessKeyId? }` | Revoke scoped credential or delete tenant bucket recursively |
+| `rotateBucketTenantCredentials` | `{ bucketName, accessKeyId, secretAccessKey, region? }` | Replace scoped credential for one bucket |
+| `listBucketTenants` | `{}` | Return scoped credential metadata |
+| `getBucketTenantCredential` | `{ bucketName }` | Return one scoped credential including secret for descriptor generation |
+| `exportBucket` | `{ bucketName }` | Export one bucket's objects and metadata |
+| `importBucket` | `{ bucketName, source }` | Import a `smartstorage.bucket.v1` bucket export |
 | `getStorageStats` | `{}` | Return cached bucket/global runtime stats + storage location capacity snapshots |
 | `listBucketSummaries` | `{}` | Return cached per-bucket runtime summaries |
 | `listCredentials` | `{}` | Return the active runtime auth credential set |
@@ -65,6 +75,7 @@
 - MD5: `{root}/{bucket}/{key}._storage_object.md5`
 - Multipart: `{root}/.multipart/{upload_id}/part-{N}`
 - Policies: `{root}/.policies/{bucket}.policy.json`
+- Runtime credentials: `{root}/.smartstorage/credentials.json`
 
 ## Build
 
@@ -82,6 +93,7 @@
 ## Testing
 
 - `test/test.aws-sdk.node.ts` - AWS SDK v3 compatibility + runtime stats + standalone cluster health coverage (19 tests, auth disabled, port 3337)
+- `test/test.bucket-tenants.node.ts` - bucket tenant provisioning, per-bucket isolation, restart persistence, export/import, policy persistence, rotation, revoke/delete, AWS SDK v3 compatibility (12 tests, port 3361)
 - `test/test.credentials.node.ts` - runtime credential rotation coverage (10 tests, auth enabled, port 3349)
 - `test/test.health-http.node.ts` - unauthenticated operational endpoint coverage (3 tests, port 3353)
 - `test/test.cluster-health.node.ts` - single-node cluster health coverage (4 tests, S3 port 3348, QUIC port 4348)