minio-init: add a public bucket with a put-only uploader

There was no way to share a file by link: both buckets are private and
the bootstrap forces anonymous access off on every run.

Add a bucket named public whose objects anyone can GET by key, with no
anonymous listing or writes, and an optional user that may only put and
delete there, so a leaked uploader key reads nothing and reaches no
other bucket.

Assisted-by: Claude:fable-5-2

SECRETS.md

@@ -75,6 +75,22 @@ The same values go on the **datacenterbingo repo**.
 | `BINGO_S3_ACCESS_KEY`  | 20-char alphanumeric.                                  |
 | `BINGO_S3_SECRET_KEY`  | 40-char alphanumeric.                                  |
 
+### Uploader for the `public` bucket
+
+Objects in `public` are readable by anyone at `https://s3.asxp.io/public/<key>`
+(no anonymous listing). This user may only put and delete there. Optional:
+without the secrets the bucket exists and only root can upload.
+
+| Secret                  | Value                 |
+|-------------------------|-----------------------|
+| `PUBLIC_S3_ACCESS_KEY`  | 20-char alphanumeric. |
+| `PUBLIC_S3_SECRET_KEY`  | 40-char alphanumeric. |
+
+```sh
+aws --endpoint-url https://s3.asxp.io --profile asxp-public \
+  s3 cp shot.png s3://public/shot.png
+```
+
 The table grants need asxpio's migrations to have run. On a fresh install,
 deploy storage again after asxpio's first boot.