vedit: hosted review URL service

[explicit09]

Problem

Render-to-review currently produces a local zip (see #13). Producers and clients need a real URL they can open in a browser — https://review.awidat.dev/<short-code> — with proxy playback, frame-accurate scrubber, and a comment box that writes back into vedit notes.

Scope (MVP — phase 1, read-only review)

1. Upload review package (proxy + manifest + thumbnails) to a configurable backend (S3-compatible by default).
2. Return a short-code URL.
3. Static viewer page: HLS proxy playback + scrubber + read-only note list.

Out of scope phase 1: write-back (see comment-ingest issue).

Layers

1. crates/core/src/review.rs — upload pathway with pluggable backend
2. crates/secrets/ — backend credentials
3. New static viewer (probably under apps/review-viewer/ — tiny SPA)
4. Test: package + upload mock + URL roundtrip

References

• Gap analysis: .reference-research/pro-editing-gap-analysis/11-collaboration.md (still open [codex] harden writes and semantic timeline diffs #2)
• Depends on vedit: render-to-review with proxy + shareable path/URL #13 (render-to-review with proxy)

[explicit09]

Closing as not actionable in the current repo. This depends on review package, S3/secrets, and review-viewer surfaces that are not present. Please reopen as a current-layout issue if/when those foundations exist.