feat(refactor): PEP8, type annotations, docstrings and PyJWT security fix

backend/app/storage.py

@@ -12,9 +12,13 @@ Two clients are maintained:
   ``MINIO_ENDPOINT`` (backwards-compatible).
 """
 
+# Import boto3
 import boto3
+
+# Import ClientError from botocore.exceptions
 from botocore.exceptions import ClientError
 
+# Import settings from app.config
 from app.config import settings
 
 # ---------------------------------------------------------------------------
@@ -25,10 +29,15 @@ _scheme = "https" if settings.MINIO_SECURE else "http"
 
 # Internal client — used for uploads and bucket management
 _client = boto3.client(
+    # Literal argument value
     "s3",
+    # Keyword argument: endpoint_url
     endpoint_url=f"{_scheme}://{settings.MINIO_ENDPOINT}",
+    # Keyword argument: aws_access_key_id
     aws_access_key_id=settings.MINIO_ACCESS_KEY,
+    # Keyword argument: aws_secret_access_key
     aws_secret_access_key=settings.MINIO_SECRET_KEY,
+    # Keyword argument: region_name
     region_name="us-east-1",  # MinIO ignores this but boto3 requires it
 )
 
@@ -51,22 +60,32 @@ _public_client = boto3.client(
 
 def ensure_bucket_exists() -> None:
     """Create the evidence bucket if it does not already exist."""
+    # Attempt the following; catch errors below
     try:
+        # Call _client.head_bucket()
         _client.head_bucket(Bucket=settings.MINIO_BUCKET)
+    # Handle ClientError
     except ClientError:
+        # Call _client.create_bucket()
         _client.create_bucket(Bucket=settings.MINIO_BUCKET)
 
 
+# Define function upload_file
 def upload_file(content: bytes, key: str) -> str:
     """Upload *content* to the evidence bucket under *key*.
 
     Returns the key that was written (same as the input).
     """
+    # Call _client.put_object()
     _client.put_object(
+        # Keyword argument: Bucket
         Bucket=settings.MINIO_BUCKET,
+        # Keyword argument: Key
         Key=key,
+        # Keyword argument: Body
         Body=content,
     )
+    # Return key
     return key
 
 
@@ -85,6 +104,8 @@ def get_presigned_url(key: str, expiration: int = 3600) -> str:
     """
     return _public_client.generate_presigned_url(
         "get_object",
+        # Keyword argument: Params
         Params={"Bucket": settings.MINIO_BUCKET, "Key": key},
+        # Keyword argument: ExpiresIn
         ExpiresIn=expiration,
     )