Provision read-only credentials for datacenterbingo

The public bingo site is moving out of the asxpio container and only
needs to read the bingo tables and the bingo/ photos. Give it a role
limited to SELECT on those two tables (with read-only transactions by
default) and a MinIO user limited to GetObject under
asxpio-invoices/bingo/, instead of reusing asxpio's read-write
credentials.

Both steps are skipped while the BINGO_* secrets are unset, so this
deploys safely before they exist. Tables missing on a fresh install
are granted on the next deploy.

Assisted-by: Claude:opus-5

docker-compose.yml

@@ -28,6 +28,7 @@ services:
       PGUSER: postgres
       PGPASSWORD: ${POSTGRES_PASSWORD}
       ASXPIO_DB_PASSWORD: ${ASXPIO_DB_PASSWORD}
+      BINGO_DB_PASSWORD: ${BINGO_DB_PASSWORD}
     volumes:
       - ./init/postgres-init.sh:/init.sh:ro
     entrypoint: ["/bin/sh", "/init.sh"]
@@ -75,6 +76,8 @@ services:
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
       ASXPIO_S3_ACCESS_KEY: ${ASXPIO_S3_ACCESS_KEY}
       ASXPIO_S3_SECRET_KEY: ${ASXPIO_S3_SECRET_KEY}
+      BINGO_S3_ACCESS_KEY: ${BINGO_S3_ACCESS_KEY}
+      BINGO_S3_SECRET_KEY: ${BINGO_S3_SECRET_KEY}
     volumes:
       - ./init/minio-bootstrap.sh:/bootstrap.sh:ro
     entrypoint: ["/bin/sh", "/bootstrap.sh"]