chore: RustFS as the only object store; retire minioadmin defaults

[pyramation]

Summary

Docker Hub removed minio/minio, which currently breaks integration-tests in this repo (minio_cdn service can't pull). Phase 1 of constructive-io/constructive-planning#2036: take MinIO out of every default path and stop shipping a well-known credential as a code default.

• CI / compose / pgpm docker start: the MinIO service is gone, RustFS pinned to rustfs/rustfs:1.0.0-rc.5 is the object store (--minio flag removed; --rustfs no longer behind a compose profile). Health probe is GET /health.
• Dev credentials renamed (single source of truth is pgpmDefaults.cdn, mirrored in OBJECT_STORE_PROFILE, docker service env, tests, snapshots, docs):

  - awsAccessKey: 'minioadmin',  awsSecretKey: 'minioadmin'
  + awsAccessKey: 'constructive', awsSecretKey: 'constructive-dev-secret'

• Production fallbacks removed in graphile-settings/upload-resolver.ts and graphql/server/scripts/create-bucket.ts — they did cdn.awsAccessKey || 'minioadmin' inside the upload path, so a misconfigured deploy silently signed as minioadmin. They now read the merged cdn from getEnvOptions() only; pgpm/env/src/assert.ts already flags cdn.* defaults in production (STRICT_ENV).
• MINIO_ENDPOINT → OBJECT_STORE_ENDPOINT in docs/test identifiers (the env var actually read is still CDN_ENDPOINT). The 'minio' BucketProvider value is unchanged — it means path-style S3-compatible and RustFS maps onto it.
• bucket-provisioner integration test assertions tightened: RustFS applies CORS, PublicAccessBlock and lifecycle rules (MinIO free didn't), so inspect() now asserts them — 17/17 pass against the pinned image locally.

Follow-up (phase 2, same issue): bump these packages in constructive-db and apply the same rename there.

Link to Devin session: https://app.devin.ai/sessions/70eb5e27252f4066a10a727d71957c05
Open in Devin Desktop: https://app.devin.ai/desktop/session/70eb5e27252f4066a10a727d71957c05?variant=devin
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. 🟡 1 medium

💬 Inline comments (1)

• 🟡 Health probe still hits MinIO path against RustFS — provisioner.integration.test.ts:53

---

This PR migrates the object-storage backend from MinIO to RustFS across local dev (docker-compose.yml), CI (.github/workflows/run-tests.yaml), and the CLI, renaming the endpoint env var from MINIO_ENDPOINT to OBJECT_STORE_ENDPOINT and swapping default credentials to constructive/constructive-dev-secret. It adds a new packages/bucket-provisioner module that applies CORS, lifecycle, versioning, and public-access-block config to buckets, updates the upload-resolver and presigned-url plugin types, and adjusts env-config assertions and snapshots accordingly.

Files	Change
docker-compose.yml, .github/workflows/run-tests.yaml	Swap MinIO service for RustFS and update health/credential env vars
packages/bucket-provisioner/src, uploads/s3-utils/src	New bucket provisioning logic and S3 client config
graphile/graphile-settings, graphile/graphile-presigned-url-plugin	Upload resolver and presigned URL type updates
pgpm/cli, pgpm/env, pgpm/types	CLI docker/env commands, env assertions, and type updates
Tests, snapshots, docs	Align integration tests and docs with RustFS migration

_{Reviewed commit: 9296f54}

[tenki-reviewer]

Migrates local and CI object storage from MinIO to RustFS, renaming endpoint/credential env vars and adding a bucket-provisioner package.

Key findings

• 🟡 Health probe still hits MinIO path against RustFS — provisioner.integration.test.ts:53

[tenki-reviewer]

🟡 bug · medium

Health probe still hits MinIO path against RustFS

The bucket-provisioner integration suite's reachability check probes ${OBJECT_STORE_ENDPOINT}/minio/health/live (packages/bucket-provisioner/tests/provisioner.integration.test.ts:53), but this PR migrated CI and local storage to RustFS, whose health endpoint is /health as set in .github/workflows/run-tests.yaml and docker-compose.yml. RustFS does not serve the MinIO-specific /minio/health/live path, so isObjectStoreReachable() always returns false and the entire suite silently skips in CI, defeating the new RustFS integration coverage this PR intends to add.

📋 Prompt for AI Agents

In packages/bucket-provisioner/tests/provisioner.integration.test.ts line 53, change the reachability fetch URL from ${OBJECT_STORE_ENDPOINT}/minio/health/live to ${OBJECT_STORE_ENDPOINT}/health. The PR migrated the storage service from MinIO to RustFS everywhere else (run-tests.yaml and docker-compose.yml both use the /health endpoint), so this probe must match or the whole integration suite silently skips against RustFS.