postResolve S3 Access Key
Resolves an access key ID to its decrypted secret, grants, disabled flag and owner (user or team) so the S3 gateway can verify SigV4 signatures. Unknown, revoked or ownerless keys return NotFound. Callers must re-resolve at least every 60 seconds so rotation and revocation propagate. Returns FailedPrecondition when the internal token or key bundle is not configured.
**Access:** internal only — requires the `X-Upl-Internal-Token` header matching the server's `S3_CREDENTIALS_INTERNAL_TOKEN` (portal worker / S3 gateway); no user authentication.