test(presign): cover the scheme-fallback branch in rewritePresignHost

Diff-cover round 2 flagged storage_presign.go lines 352-353 (the
`if scheme == "" { scheme = signed.Scheme }` branch) as untested. The prior
subtest passed "http://..." which set Scheme to "http", missing the
fallback. New subtest uses a protocol-relative "//cdn.instanode.dev" so
url.Parse returns Scheme=="" and the branch fires. signed URL was https,
so the rewritten output must inherit https — pinned.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Manas Srivastava

internal/handlers/storage_presign_test.go

@@ -131,16 +131,25 @@ func TestRewritePresignHost_CanonicalHostSubstitution(t *testing.T) {
 		assert.Equal(t, "", out)
 	})
 
-	t.Run("publicURL inherits signed scheme when scheme missing", func(t *testing.T) {
-		// Test the scheme-fallback branch where publicURL is parsed as a
-		// host-only string (no scheme). url.Parse on a bare host returns
-		// {Scheme:"" Host:""} (it lands in Opaque) — so synthesize a
-		// scheme-less URL by passing "//host/path".
+	t.Run("publicURL with explicit scheme overrides signed scheme", func(t *testing.T) {
+		// publicURL with explicit scheme — verify that scheme wins.
 		signed, err := url.Parse(signedRaw)
 		assert.NoError(t, err)
-		// publicURL with scheme but bare host — verify scheme override path.
 		out, ok := rewritePresignHost(signed, "http://s3.instanode.dev")
 		assert.True(t, ok)
 		assert.True(t, strings.HasPrefix(out, "http://s3.instanode.dev/"))
 	})
+
+	t.Run("publicURL with no scheme inherits signed scheme", func(t *testing.T) {
+		// Protocol-relative URL: url.Parse on "//host/path" returns
+		// {Scheme:"" Host:"host"}. Exercises the
+		// `if scheme == "" { scheme = signed.Scheme }` branch.
+		signed, err := url.Parse(signedRaw)
+		assert.NoError(t, err)
+		out, ok := rewritePresignHost(signed, "//cdn.instanode.dev")
+		assert.True(t, ok, "protocol-relative publicURL must still rewrite")
+		// signed had scheme "https" — must be preserved on rewrite.
+		assert.True(t, strings.HasPrefix(out, "https://cdn.instanode.dev/"),
+			"scheme must fall back to the signed URL's scheme; got %q", out)
+	})
 }