Generalize the S3 client with S3_ENDPOINT + S3_FORCE_PATH_STYLE and drop
the per-object public-read ACL so any S3-compatible backend works via a
bucket policy. Ship a docker-compose.yml that runs RustFS with a perms
init (UID 10001) and an mc-based bucket init alongside the app.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>