Add Garage beside MinIO

MinIO is abandoned upstream and its images are gone from the registries,
so the object store cannot be rebuilt or updated. Garage takes its
place.

This is the first step: Garage runs as one node next to MinIO, with the
same three buckets and one key per app, and is not routed yet. MinIO
keeps serving s3.asxp.io and is no longer bootstrapped, so its users
stay as they are until the data is copied and the apps are switched.

Garage only accepts keys in its own format. The bootstrap hashes the
existing secrets into that format, as the apps' deploys will, so no
secret has to change for the move; a secret already in Garage's format
is used as it is.

Garage has no anonymous S3 access. The public bucket is marked as a
website instead, to be served through Garage's web endpoint.

Assisted-by: Claude:fable-5-2

docker-compose.yml

@@ -65,31 +65,35 @@ services:
       - "traefik.http.routers.minio-s3.service=minio-s3"
       - "traefik.http.services.minio-s3.loadbalancer.server.port=9000"
 
-  minio-init:
-    image: minio/mc:latest
-    container_name: storage-minio-init
-    depends_on:
-      minio:
-        condition: service_healthy
-    environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
-      ASXPIO_S3_ACCESS_KEY: ${ASXPIO_S3_ACCESS_KEY}
-      ASXPIO_S3_SECRET_KEY: ${ASXPIO_S3_SECRET_KEY}
-      BINGO_S3_ACCESS_KEY: ${BINGO_S3_ACCESS_KEY}
-      BINGO_S3_SECRET_KEY: ${BINGO_S3_SECRET_KEY}
-      PUBLIC_S3_ACCESS_KEY: ${PUBLIC_S3_ACCESS_KEY}
-      PUBLIC_S3_SECRET_KEY: ${PUBLIC_S3_SECRET_KEY}
+  # Replaces MinIO (abandoned upstream; its images are gone from the
+  # registries). Not routed yet: MinIO still answers s3.asxp.io until the data
+  # is copied and the apps are switched.
+  garage:
+    image: dxflrs/garage:v2.5.0
+    container_name: storage-garage
+    restart: unless-stopped
+    command: ["/garage", "server", "--single-node"]
     volumes:
-      - ./init/minio-bootstrap.sh:/bootstrap.sh:ro
-    entrypoint: ["/bin/sh", "/bootstrap.sh"]
+      - ./garage.toml:/etc/garage.toml:ro
+      - ./secrets/garage_rpc_secret:/run/secrets/garage_rpc_secret:ro
+      - garage_meta:/var/lib/garage/meta
+      - garage_data:/var/lib/garage/data
     networks:
       - storage
-    restart: "no"
+      - traefik
+    healthcheck:
+      test: ["CMD", "/garage", "status"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    labels:
+      - "traefik.enable=false"
 
 volumes:
   pg_data:
   minio_data:
+  garage_meta:
+  garage_data:
 
 networks:
   storage: