feat(storage): Firestore KVStore + KVProvider abstraction

Phase 04 of go-port-cloud-run plan. Introduces KVProvider abstraction
with memory backend (via Prefixed wrapper) and Firestore backend (via
collection-per-module isolation). Backend selection gated by env vars:
GOOGLE_CLOUD_PROJECT or FIRESTORE_EMULATOR_HOST → Firestore, else memory.
Emulator-gated tests via `make test-emulator`. Security hardened: emulator
fallback project ID, prefix validation on List, length-in-bytes docs.

internal/server/router_test.go

@@ -15,7 +15,7 @@ const testCronSecret = "shared-cron-secret"
 
 func buildRegistry(t *testing.T, factories map[string]modules.Factory, names ...string) *modules.Registry {
 	t.Helper()
-	reg, err := modules.Build(names, factories, modules.Deps{KV: storage.NewMemoryKVStore()})
+	reg, err := modules.Build(names, factories, storage.NewMemoryProvider(), nil)
 	if err != nil {
 		t.Fatalf("modules.Build: %v", err)
 	}