The public bingo site is moving out of the asxpio container and only
needs to read the bingo tables and the bingo/ photos. Give it a role
limited to SELECT on those two tables (with read-only transactions by
default) and a MinIO user limited to GetObject under
asxpio-invoices/bingo/, instead of reusing asxpio's read-write
credentials.
Both steps are skipped while the BINGO_* secrets are unset, so this
deploys safely before they exist. Tables missing on a fresh install
are granted on the next deploy.
Assisted-by: Claude:opus-5
