Provision read-only credentials for datacenterbingo

The public bingo site is moving out of the asxpio container and only
needs to read the bingo tables and the bingo/ photos. Give it a role
limited to SELECT on those two tables (with read-only transactions by
default) and a MinIO user limited to GetObject under
asxpio-invoices/bingo/, instead of reusing asxpio's read-write
credentials.

Both steps are skipped while the BINGO_* secrets are unset, so this
deploys safely before they exist. Tables missing on a fresh install
are granted on the next deploy.

Assisted-by: Claude:opus-5

init/minio-bootstrap.sh

@@ -37,6 +37,27 @@ EOF
     || mc admin policy update local "${name}" "/tmp/${name}.json"
 }
 
+# Read-only on one prefix of a bucket.
+write_ro_prefix_policy() {
+  name="$1"
+  bucket="$2"
+  prefix="$3"
+  cat > "/tmp/${name}.json" <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:GetObject"],
+      "Resource": ["arn:aws:s3:::${bucket}/${prefix}*"]
+    }
+  ]
+}
+EOF
+  mc admin policy create local "${name}" "/tmp/${name}.json" 2>/dev/null \
+    || mc admin policy update local "${name}" "/tmp/${name}.json"
+}
+
 ensure_user() {
   access="$1"
   secret="$2"
@@ -53,4 +74,12 @@ ensure_bucket "asxpio-invoices"
 write_policy  "asxpio-invoices-rw" "asxpio-invoices"
 ensure_user   "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw"
 
+# datacenterbingo serves the card photos asxpio's admin uploads under bingo/.
+if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then
+  write_ro_prefix_policy "asxpio-invoices-bingo-ro" "asxpio-invoices" "bingo/"
+  ensure_user   "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "asxpio-invoices-bingo-ro"
+else
+  echo "minio-init: BINGO_S3_* unset, skipping bingo user"
+fi
+
 echo "minio-init: done"