refactor(plan): unify bucket validation + lock root-verb routing

- web-api create-bucket and s3 virtual-host now use BucketNameSchema
  (single canonical validator; no inline regex left in src/)
- routes '/': HEAD/DELETE/POST now check shouldHandleS3 with headers
  like every other branch (non-S3 -> 404, never S3-direct blind)
- s3-routing.test.ts: 3 new tests locking the fixed root verbs

test/s3-routing.test.ts

@@ -129,4 +129,21 @@ describe('S3 routing (routes table)', () => {
     );
     expect(res.status).toBe(204);
   });
+
+  it('answers HEAD / without S3 headers as 404 (never S3-direct)', async () => {
+    const res = await routes['/'].HEAD(new Request('http://localhost:4000/', { method: 'HEAD' }));
+    expect(res.status).toBe(404);
+  });
+
+  it('answers DELETE / without S3 headers as 404 (never S3-direct)', async () => {
+    const res = await routes['/'].DELETE(
+      new Request('http://localhost:4000/', { method: 'DELETE' }),
+    );
+    expect(res.status).toBe(404);
+  });
+
+  it('answers POST / without S3 headers as 404 (never S3-direct)', async () => {
+    const res = await routes['/'].POST(new Request('http://localhost:4000/', { method: 'POST' }));
+    expect(res.status).toBe(404);
+  });
 });