Feature: Support AWS default credential chain for S3 #431

Problem

The S3 provider currently requires AWS_ACCESS_KEY and AWS_SECRET_KEY and always configures a static credentials provider.

This prevents transfer.sh from using the AWS SDK's default credential chain, including:

• EC2 instance profiles
• ECS task roles
• EKS IAM roles for service accounts (IRSA)
• Standard AWS environment variables
• Shared AWS credentials/configuration files
• Other credential providers supported by the AWS SDK

Requiring long-lived static credentials makes automated cloud deployments harder and introduces unnecessary secret-management and rotation risks. Role-based credentials are temporary, rotated automatically, and are the recommended approach for AWS workloads.

This is also relevant to the Helm chart: it supports service-account annotations and can omit an S3 credentials secret, but transfer.sh currently refuses to start without its static key flags.

Proposed behavior

Continue using the existing s3 provider; a separate s3-ec2role provider is unnecessary because the storage backend remains S3.

• When both aws-access-key and aws-secret-key are provided, use them as static credentials for backward compatibility.
• When neither is provided, use the AWS SDK default credential chain.
• When only one is provided, return a clear configuration error.
• Continue requiring the bucket and region configuration.

Benefits

• Avoids storing long-lived AWS credentials.
• Supports EC2, ECS, and EKS deployments naturally.
• Enables automatic credential rotation.
• Preserves existing S3 and S3-compatible storage configurations.
• Uses standard AWS SDK behavior rather than custom EC2 metadata handling.

Acceptance criteria

• Existing static-key configurations continue to work unchanged.
• S3 works without transfer.sh-specific keys when credentials are available through the AWS SDK default chain.
• Partial static credentials produce a clear error.
• Tests cover static credentials, default-chain credentials, and partial credentials.
• Documentation describes role-based authentication and the default credential chain.

Related implementation: #433