Implement Option B (enhanced env var) for T058.S2:
- Support multiple S3 credentials via S3_CREDENTIALS env var
- Format: "key1:secret1,key2:secret2,..."
- Backward compatible with S3_ACCESS_KEY_ID/S3_SECRET_KEY
- Add tests for both multi and single credential formats
This unblocks T039 production deployment while proper IAM
credential service (T060) is implemented separately.
Tests: 10/10 auth tests pass (added 2 new credential tests)
Refs: T058.S2 Option B (approved), T060 (proper IAM integration)
