Use S3 for upload storage in prod

Needs two new ENV variables: `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` cc @mattmb.

FYI this approach is undocumented so might not work but AFAICT it will work fine.
that's fine. we want s3 everywhere apart from dev (and maybe CI), we'll need S3 creeds per env.