refactor(objstore): build the credentialed S3 URL in the lookup

7b5833b37a assembled it in zammad's env template: urlencode both halves of the
credential by hand, patch them into the URL the lookup had already returned,
then append bucket and query. Three set-statements of string surgery on a value
the lookup builds from host and port in the first place.

The lookup now exposes credentialed_url next to url, built from the same
endpoint it already has, with urllib.parse.quote(safe='') on each half. The
template keeps only what is actually zammad's: the bucket path and the region /
force_path_style query.

This also removes the manual scheme concatenation that
test_onion_url_central_lookup refuses. That rule guards against a hand-built
app URL repeating the clearnet-vs-onion decision; the template was not doing
that, but it did name '://' and could therefore touch the scheme. Now it
cannot.

quote(x, safe='') is equivalent to the old
chain: checked over slashes, plus, equals, percent and space, no divergence.
Both branches of the lookup carry the key, the disabled one as the empty
string, so a consumer cannot hit a missing key.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/plugins/lookup/test_objstore.py

@@ -148,6 +148,33 @@ class ObjstoreLookupTests(unittest.TestCase):
             "http://seaweedfs-central:8334",
         )
 
+    def test_credentialed_url_percent_encodes_both_halves(self):
+        applications = {
+            "web-app-foo": {
+                "services": {"seaweedfs": {"enabled": True, "shared": True}},
+                "secrets": {"credentials": {"objstore_secret_key": "a/b+c=d"}},
+            },
+            "web-svc-seaweedfs": {
+                "services": {
+                    "seaweedfs": {"name": "seaweedfs-central", "api_port": 8334}
+                },
+            },
+        }
+
+        out = self._run(["web-app-foo"], applications)[0]
+
+        self.assertEqual(
+            out["credentialed_url"],
+            "http://foo:a%2Fb%2Bc%3Dd@seaweedfs-central:8334",
+        )
+        self.assertEqual(out["url"], "http://seaweedfs-central:8334")
+
+    def test_credentialed_url_is_empty_without_an_engine(self):
+        applications = {"web-app-foo": {"services": {}}}
+        self.assertEqual(
+            self._run(["web-app-foo", "credentialed_url"], applications)[0], ""
+        )
+
     def test_public_url_scheme_follows_provider_tls(self):
         applications = {
             "web-app-foo": {