garage-bootstrap: let asxpio write to the public bucket

asxpio's admin is getting a page for uploading files meant for public
use. They belong in the public bucket, which so far only the
public-upload key could write to. Grant asxpio's existing key put and
delete there instead of handing the app a second set of credentials.

Write-only is enough: the app keeps its own index of what it uploaded
and never reads the objects back.

Assisted-by: Claude:fable-5-2

README.md

@@ -32,7 +32,8 @@ Garage answers no anonymous S3 request. `public` is marked as a website
 instead, and Traefik sends unsigned GET/HEAD of
 `https://s3.asxp.io/public/<key>` to Garage's web endpoint. Anyone who knows a
 key can read it; nobody can list the bucket. Uploading needs the uploader key
-(see `SECRETS.md`).
+(see `SECRETS.md`) or asxpio's key, which may put and delete there for its
+admin's file uploads.
 
 ## Looking inside
 

init/garage-bootstrap.sh

@@ -84,6 +84,8 @@ g bucket website --allow public >/dev/null
 asxpio="$(ensure_key asxpio "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}")"
 grant "asxpio-invoices" "$asxpio" rw
 grant "datacenterbingo-photos" "$asxpio" rw
+# asxpio's admin publishes and retracts files; it keeps its own index.
+grant "public" "$asxpio" wo
 
 if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then
   bingo="$(ensure_key bingo "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}")"