fix: stream ES signed UploadParts to prevent OOM

[ServerSideHannes]

Summary

• Route signed, known-length, non-chunked UploadParts (e.g. Elasticsearch 16MB snapshot parts) through the framed O(frame)-memory path instead of buffering the whole body
• Stop pre-reading request bodies in request_handler when x-amz-content-sha256 is present — the SigV4 verifier uses the header hash directly
• Add classify_upload() unit tests guarding the ES regression

Prod logs showed upload_path: "buffered" with is_large_signed: false for 16MB ES parts, reserving only 8MB while actual peak was ~50MB/request → OOMKilled at 512Mi.

Test plan

• uv run pytest tests/unit/test_upload_path.py tests/unit/test_routing.py -q
• uv run pytest tests/unit/ -q (431 passed)
• Deploy to staging and confirm ES snapshot uploads log upload_path: "framed"
• Monitor s3proxy-python pods for OOMKilled restarts during ES backup window

Made with Cursor