feat(delete): warn when a hosted file is left behind by locked storage

Deleting a video removes the Nostr note(s) but cleanup of the underlying R2/S3
object was silently skipped when storage was locked — leaving the file publicly
downloadable with no indication to the user. Now the delete flow surfaces a
clear heads-up when that happens, telling the user to unlock storage and delete
again (or remove the object from their bucket manually).

To make the signal accurate, deleteVideoStorage now resolves the affected object
keys BEFORE the credentials check (publicBaseUrl is available even while
locked). So "storage-locked" is reported only when there are genuinely hosted
objects to remove; an external-URL video (nothing on the user's bucket) returns
"no-matching-objects" and never triggers a false warning.

Tests (deleteVideoStorage via injected credentials/deleteObject): locked +
hosted object -> storage-locked; locked + external URL -> no-matching-objects
(no false alarm); unlocked -> actually deletes the object. Mutation-verified —
restoring the old credentials-first ordering misreports the external-URL case.

Build + full lint green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

js/app.js

@@ -4559,6 +4559,7 @@ class Application {
       // Best-effort: remove the underlying R2/S3 object(s) now that the note(s)
       // are gone, so the file isn't left publicly downloadable. This never
       // blocks the delete — failures are logged only.
+      let storageLockedRemnant = false;
       try {
         const cleanup = await r2Service.deleteVideoStorage({
           videos: [targetVideo],
@@ -4570,6 +4571,12 @@ class Application {
           );
         } else if (cleanup?.skipped) {
           devLogger.log(`[delete] Storage cleanup skipped: ${cleanup.reason}.`);
+          // The note is gone but the hosted file is still publicly downloadable
+          // because storage is locked. Warn the user so they can unlock and
+          // delete again (or remove it from their bucket manually).
+          if (cleanup.reason === "storage-locked") {
+            storageLockedRemnant = true;
+          }
         }
       } catch (cleanupErr) {
         devLogger.warn(
@@ -4580,6 +4587,12 @@ class Application {
 
       await this.loadVideos();
       this.showSuccess("All versions deleted successfully!");
+      if (storageLockedRemnant) {
+        this.showStatus(
+          "Heads up: the hosted file is still in your storage bucket because storage is locked. Unlock storage and delete again, or remove it from your bucket manually.",
+          { autoHideMs: 12000, showSpinner: false }
+        );
+      }
       this.deleteModal.close();
       this.forceRefreshAllProfiles();
     } catch (err) {

js/services/r2Service.js

@@ -154,19 +154,31 @@ export class R2Service {
       ""
     ).trim();
 
-    if (!accessKeyId || !secretAccessKey) {
-      // Storage is locked / keys unavailable — can't delete without them.
-      return skip("storage-locked");
-    }
-    if (!bucket || !publicBaseUrl) {
+    if (!publicBaseUrl) {
+      // Without the public base URL we can't tell which objects belong to this
+      // user's bucket, so there's nothing safe to remove.
       return skip("missing-bucket-or-base-url");
     }
 
+    // Determine the affected objects BEFORE the credentials check. publicBaseUrl
+    // is available even while storage is locked, so this lets us report
+    // "storage-locked" only when there are genuinely hosted objects to remove —
+    // an external-URL video (no matching objects) is never a false alarm.
     const keys = collectVideoStorageKeys({ videos: list, publicBaseUrl });
     if (!keys.length) {
       return skip("no-matching-objects");
     }
 
+    if (!accessKeyId || !secretAccessKey) {
+      // There ARE objects to remove but storage is locked / keys unavailable —
+      // surface this distinctly so the caller can warn the user the hosted
+      // files were left behind.
+      return skip("storage-locked");
+    }
+    if (!bucket) {
+      return skip("missing-bucket-or-base-url");
+    }
+
     let s3;
     try {
       await ensureS3SdkLoaded();