Support model repos and bare paths in addition to buckets/ prefix

add minimal UI on /

GET /sign with query params + token via t=

force https in signed URL

init bucket-proxy