feat(desktop): add client release updater

server/internal/shared/config/config_test.go

@@ -108,6 +108,34 @@ retrieval:
 	}
 }
 
+func TestLoadAppliesObjectStorageEnvOverrides(t *testing.T) {
+	t.Setenv("OBJECT_STORAGE_BUCKET_ACL", "private")
+	t.Setenv("OBJECT_STORAGE_OBJECT_ACL", "public-read")
+	t.Setenv("OBJECT_STORAGE_SIGNED_URL_TTL", "45m")
+
+	configPath := writeTestConfig(t, `
+object_storage:
+  bucket_acl: public-read
+  object_acl: private
+  signed_url_ttl: 10m
+`)
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+
+	if cfg.ObjectStorage.BucketACL != "private" {
+		t.Fatalf("expected env bucket acl, got %q", cfg.ObjectStorage.BucketACL)
+	}
+	if cfg.ObjectStorage.ObjectACL != "public-read" {
+		t.Fatalf("expected env object acl, got %q", cfg.ObjectStorage.ObjectACL)
+	}
+	if cfg.ObjectStorage.SignedURLTTL != 45*time.Minute {
+		t.Fatalf("expected env signed url ttl, got %s", cfg.ObjectStorage.SignedURLTTL)
+	}
+}
+
 func TestLoadAppliesBrandLibraryDefaults(t *testing.T) {
 	configPath := writeTestConfig(t, `
 brand_library: {}