refactor(s3): drop dead getPublicUrl gateway method

No callers remain after select('public') was removed in #456 — the
public-bucket flow is gone, so the gateway method, its port declaration
and its tests are dead code.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/adapters/gateways/s3.test.ts

@@ -322,27 +322,6 @@ describe('S3Service', () => {
     })
   })
 
-  describe('getPublicUrl', () => {
-    it('uses customHost when available', () => {
-      const s = makeStorage({ customHost: 'https://cdn.example.com' })
-      expect(service.getPublicUrl(s, 'a/b.jpg')).toBe('https://cdn.example.com/a/b.jpg')
-    })
-
-    it('strips trailing slash from customHost', () => {
-      const s = makeStorage({ customHost: 'https://cdn.example.com/' })
-      expect(service.getPublicUrl(s, 'a/b.jpg')).toBe('https://cdn.example.com/a/b.jpg')
-    })
-
-    it('falls back to endpoint/bucket when no customHost', () => {
-      expect(service.getPublicUrl(storage, 'a/b.jpg')).toBe('https://s3.example.com/my-bucket/a/b.jpg')
-    })
-
-    it('strips trailing slash from endpoint', () => {
-      const s = makeStorage({ endpoint: 'https://s3.example.com/' })
-      expect(service.getPublicUrl(s, 'a/b.jpg')).toBe('https://s3.example.com/my-bucket/a/b.jpg')
-    })
-  })
-
   describe('headObject', () => {
     it('returns size, contentType, and the quote-stripped etag', async () => {
       mockSend.mockResolvedValueOnce({

server/adapters/gateways/s3.ts

@@ -196,13 +196,6 @@ export class S3Service implements S3Gateway {
     return parsed.toString()
   }
 
-  getPublicUrl(storage: S3StorageCredentials, key: string): string {
-    if (storage.customHost) {
-      return `${storage.customHost.replace(/\/$/, '')}/${key}`
-    }
-    return `${storage.endpoint.replace(/\/$/, '')}/${storage.bucket}/${key}`
-  }
-
   async headObject(
     storage: S3StorageCredentials,
     key: string,

server/usecases/ports/s3.ts

@@ -34,7 +34,6 @@ export interface S3Gateway {
   abortMultipartUpload(storage: S3StorageCredentials, key: string, uploadId: string): Promise<void>
   presignDownload(storage: S3StorageCredentials, key: string, filename: string, expiresIn?: number): Promise<string>
   presignInline(storage: S3StorageCredentials, key: string, mime: string, expiresIn?: number): Promise<string>
-  getPublicUrl(storage: S3StorageCredentials, key: string): string
   // `etag` is the S3 ETag with surrounding quotes stripped (= content MD5 for a
   // single PutObject); used to verify a finalized single-PUT upload.
   headObject(storage: S3StorageCredentials, key: string): Promise<{ size: number; contentType: string; etag: string }>