GCSMediaStorage stores agent media in a Google Cloud Storage bucket and keeps only a MediaReference in the database.
AsyncGCSMediaStorage takes the same parameters and runs each call in a worker thread.
Signing needs a credential that carries a private key, from
credentials_path or a service-account JSON on GOOGLE_APPLICATION_CREDENTIALS. Application-default credentials carry only a token, so get_url returns None and readers stream the bytes through download instead. public=True skips signing and always returns a URL.