oauth-restricted traces, download + agent-prompt buttons

docs: mounted bucket, open uploads

storage: mounted bucket volume, no token; open uploads

tracebin: capability-URL pastebin for agent traces

initial commit