Use router KEK for object encryption

[louisgls]

Summary

• pass the KEK computed by Router.New() into GET/PUT object handlers
• remove per-request environment lookup for S3PROXY_ENCRYPT_KEY inside handlers
• keep forwarding paths requiring a concrete S3 client, while allowing object handlers to use the internal S3 client interface
• add a regression test proving PUT encryption uses the router KEK and cannot be decrypted with a zero KEK

Closes #21.

Validation

• go test ./...
• CGO_ENABLED=0 GOOS=linux go build -o /tmp/s3proxy-kek ./s3proxy/cmd

Not run: bazel test //s3proxy/internal/router:router_test because bazel is not installed in this local environment.