Provision read-only credentials for datacenterbingo

The public bingo site is moving out of the asxpio container and only
needs to read the bingo tables and the bingo/ photos. Give it a role
limited to SELECT on those two tables (with read-only transactions by
default) and a MinIO user limited to GetObject under
asxpio-invoices/bingo/, instead of reusing asxpio's read-write
credentials.

Both steps are skipped while the BINGO_* secrets are unset, so this
deploys safely before they exist. Tables missing on a fresh install
are granted on the next deploy.

Assisted-by: Claude:opus-5

init/postgres-init.sh

@@ -33,4 +33,29 @@ ensure_role "asxpio" "${ASXPIO_DB_PASSWORD}"
 ensure_db   "asxpio" "asxpio"
 ensure_extension "asxpio" "citext"
 
+# datacenterbingo: read-only on the bingo tables in the asxpio DB (asxpio's
+# admin writes them and owns the schema). Tables that don't exist yet (fresh
+# install, asxpio not migrated) are granted on the next storage deploy.
+if [ -n "${BINGO_DB_PASSWORD:-}" ]; then
+  ensure_role "bingo" "${BINGO_DB_PASSWORD}"
+  psql -c "ALTER ROLE bingo SET default_transaction_read_only = on;"
+  psql -d asxpio -v ON_ERROR_STOP=1 <<'SQL'  # heredoc body stays at column 0
+GRANT CONNECT ON DATABASE asxpio TO bingo;
+GRANT USAGE ON SCHEMA public TO bingo;
+DO $$
+DECLARE t text;
+BEGIN
+  FOREACH t IN ARRAY ARRAY['bingo_datacenters', 'bingo_incidents'] LOOP
+    IF to_regclass('public.' || t) IS NOT NULL THEN
+      EXECUTE format('GRANT SELECT ON public.%I TO bingo', t);
+    ELSE
+      RAISE NOTICE 'bingo: % missing, not granted yet', t;
+    END IF;
+  END LOOP;
+END $$;
+SQL
+else
+  echo "postgres-init: BINGO_DB_PASSWORD unset, skipping bingo role"
+fi
+
 echo "postgres-init: done"