[CRITICAL][KYC STORAGE] Move encrypted identity documents behind private blob access

[Obiajulu-gif]

Summary

Encrypted KYC envelopes are stored in blobs configured as publicly readable. Encryption reduces exposure, but public object access enables unlimited ciphertext harvesting and makes authorization dependent on cryptography alone.

Repository evidence

• app/api/upload/route.ts uploads KYC payloads with access: "public".
• Application routes already provide authenticated/signed document access paths.

Scope

• Store KYC objects in private/non-public storage and serve them only through the authorized document proxy.
• Migrate existing object references without exposing raw storage URLs.
• Add access logging, cache-control, and revocation behavior.

Acceptance criteria

• A raw KYC blob URL is not anonymously retrievable.
• Authorized owner/admin signed access still works for the configured TTL.
• Existing public objects are migrated or revoked with an auditable inventory.

Tests

• Anonymous-versus-authorized retrieval tests and expired/revoked token tests.
• Migration test for an existing KYC record.

Non-goals

• Changing public vehicle images or the encryption algorithm.

[BigDella]

i will love to work on this issue

[grantfox-oss]

🦊 GrantFox — @BigDella has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #175)
2. Your PR will be reviewed by the Chainmove maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

@BigDella's PR #207 was approved and merged by @Obiajulu-gif.

🏆 @BigDella: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (411 total points). Track your full progress on GrantFox.

👏 Great work, @BigDella! Keep contributing to Chainmove.