fix(infra): restore pinned MinIO compose image

[Roddygithub]

Root cause
Docker Hub minio/minio was deleted (2026-09-11). Quay.io's minio/minio now denies
anonymous pull (token grants actions:[]). dl.min.io/server/minio/release/ returns HTTP
410. Upstream Community Edition is archived (2026-04-25) and source-only.

What was already fixed
PR #309 repaired CI (.github/workflows/ci.yml) by downloading the official
RELEASE.2025-09-07T16-13-09Z binary from github.com/minio/minio/releases and
verifying its SHA-256 at runtime.

What this PR fixes
The remaining local/prod docker-compose.yml and docker-compose.prod.yml paths,
which still referenced the deleted/unpullable images.

Changes

• New docker/minio/Dockerfile (59 lines): builds a thin debian:bookworm-slim image
  around the official GitHub Release binary.
• ARG MINIO_RELEASE=RELEASE.2025-09-07T16-13-09Z
• Per-arch SHA-256 pins (from the release's official .sha256sum assets):
  • MINIO_SHA256_AMD64=7c5bd8512c6e966455b1d198209358b2d191c77a83ab377c4073281065fb855f
  • MINIO_SHA256_ARM64=5c83cd2cf151717ba0243f73e1c7802ff36e272b67144bdd7f1f7d684fd6f03d
• Build-time sha256sum -c - fails the build on any mismatch.
• TARGETARCH declared without default (so --platform linux/arm64 correctly selects
  the arm64 binary and hash).
• ENTRYPOINT/CMD preserve the compose command:.
• Both compose files now use image: gw2a-minio:RELEASE.2025-09-07T16-13-09Z +
  build: {context: ., dockerfile: docker/minio/Dockerfile}.
  • dev: keeps published ports 9000/9001.
  • prod: no published ports, restart: unless-stopped.

Validation

• docker compose config -q passes for both files.
• Build succeeds; negative test (--build-arg MINIO_SHA256_AMD64=00...) fails with
  sha256sum: WARNING: 1 computed checksum did NOT match.
• Dev container: healthy, host health endpoint 200, console 200.
• Credentials + bucket create + S3 put/get round-trip all OK; wrong secret rejected.
• docker compose restart minio → healthy, data survives (named volume miniodata).
• Prod container: healthy, no published ports, restart=unless-stopped, in-network
  health 200, same credential/round-trip validation passes.
• Repository smoke test: RUN_INTEGRATION_TESTS=1 uv run pytest apps/api/tests/test_integration_minio.py -v → 2 passed.
• Upload e2e + edge cases: 0 failed (unrelated skips only).

Independent review
Two rounds; final verdict ACCEPT after fixing TARGETARCH handling (round 1 found
ARG TARGETARCH=amd64 default overriding BuildKit's automatic value — fixed to
ARG TARGETARCH).

No latest, no third-party image, no unrelated changes.