Provision read-only credentials for datacenterbingo

The public bingo site is moving out of the asxpio container and only
needs to read the bingo tables and the bingo/ photos. Give it a role
limited to SELECT on those two tables (with read-only transactions by
default) and a MinIO user limited to GetObject under
asxpio-invoices/bingo/, instead of reusing asxpio's read-write
credentials.

Both steps are skipped while the BINGO_* secrets are unset, so this
deploys safely before they exist. Tables missing on a fresh install
are granted on the next deploy.

Assisted-by: Claude:opus-5

SECRETS.md

@@ -59,6 +59,24 @@ can connect.
 | `ASXPIO_S3_ACCESS_KEY`  | 20-char alphanumeric, see snippet above.                       |
 | `ASXPIO_S3_SECRET_KEY`  | 40-char alphanumeric, see snippet above.                       |
 
+### Per-app credentials provisioned for datacenterbingo
+
+These are read-only:
+- Role `bingo` gets SELECT on `bingo_datacenters` and `bingo_incidents` in
+  the `asxpio` DB, and `default_transaction_read_only`.
+- The MinIO user may only `GetObject` under `asxpio-invoices/bingo/`.
+
+The same values go on the **datacenterbingo repo**.
+
+| Secret                 | Value                                                  |
+|------------------------|--------------------------------------------------------|
+| `BINGO_DB_PASSWORD`    | Postgres password for the `bingo` role. `openssl rand -hex 32`. |
+| `BINGO_S3_ACCESS_KEY`  | 20-char alphanumeric.                                  |
+| `BINGO_S3_SECRET_KEY`  | 40-char alphanumeric.                                  |
+
+The table grants need asxpio's migrations to have run. On a fresh install,
+deploy storage again after asxpio's first boot.
+
 ## After adding secrets
 
 1. Push to `main`. The Forgejo workflow brings Postgres and MinIO up, then runs