s3-proxy: expose x-amz-restore response header via CORS

The catalog file page reads an object's Glacier / Deep Archive restore
state from the x-amz-restore HEAD response header; browsers only surface
that header cross-origin when it's listed in Access-Control-Expose-Headers.

Split out of #4921 (catalog Glacier rehydration UX) so this s3-proxy image
change is independently reviewable and deployable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: nl0

s3-proxy/nginx.conf

@@ -38,7 +38,7 @@ http {
             add_header 'Access-Control-Allow-Methods' $http_access_control_request_method always;
             add_header 'Access-Control-Allow-Origin' '*' always;
             add_header 'Access-Control-Max-Age' '3000' always;
-            add_header 'Access-Control-Expose-Headers' 'Content-Length, Content-Range, ETag, x-amz-meta-helium, x-amz-bucket-region, x-amz-delete-marker, x-amz-request-id, x-amz-version-id, x-amz-storage-class' always;
+            add_header 'Access-Control-Expose-Headers' 'Content-Length, Content-Range, ETag, x-amz-meta-helium, x-amz-bucket-region, x-amz-delete-marker, x-amz-request-id, x-amz-version-id, x-amz-storage-class, x-amz-restore' always;
 
             # Return success on OPTIONS.
             if ($request_method = 'OPTIONS') {