minio-init: add a public bucket with a put-only uploader

There was no way to share a file by link: both buckets are private and
the bootstrap forces anonymous access off on every run.

Add a bucket named public whose objects anyone can GET by key, with no
anonymous listing or writes, and an optional user that may only put and
delete there, so a leaked uploader key reads nothing and reaches no
other bucket.

Assisted-by: Claude:fable-5-2

docker-compose.yml

@@ -78,6 +78,8 @@ services:
       ASXPIO_S3_SECRET_KEY: ${ASXPIO_S3_SECRET_KEY}
       BINGO_S3_ACCESS_KEY: ${BINGO_S3_ACCESS_KEY}
       BINGO_S3_SECRET_KEY: ${BINGO_S3_SECRET_KEY}
+      PUBLIC_S3_ACCESS_KEY: ${PUBLIC_S3_ACCESS_KEY}
+      PUBLIC_S3_SECRET_KEY: ${PUBLIC_S3_SECRET_KEY}
     volumes:
       - ./init/minio-bootstrap.sh:/bootstrap.sh:ro
     entrypoint: ["/bin/sh", "/bootstrap.sh"]