asxpio's migration 017 adds bingo_monitor_targets, _samples and
_buckets for datacenterbingo's status page. The migration grants them
itself; list them here too so a fresh install gets the same grants.
Assisted-by: Claude:opus-5-5
The public bingo site is moving out of the asxpio container and only
needs to read the bingo tables and the bingo/ photos. Give it a role
limited to SELECT on those two tables (with read-only transactions by
default) and a MinIO user limited to GetObject under
asxpio-invoices/bingo/, instead of reusing asxpio's read-write
credentials.
Both steps are skipped while the BINGO_* secrets are unset, so this
deploys safely before they exist. Tables missing on a fresh install
are granted on the next deploy.
Assisted-by: Claude:opus-5
