feat(minio): Expand CRDs to include Policies and Users — full YAML-driven resource creation

Add MinIO Policies and Users via CRD alongside Buckets.

Resources now declarative:
- Bucket: riotpiao-models (versioning enabled)
- Policy: policy-ollama (scoped bucket access)
- User: user-ollama (service account for Ollama/LLM)

Access keys can be overridden via SOPS or kustomize overlays.
All MinIO resource creation now git-tracked and version controlled.

k8s/infrastructure/minio/buckets.yaml

@@ -1,3 +1,5 @@
+---
+# Buckets
 apiVersion: minio.min.io/v1alpha1
 kind: Bucket
 metadata:
@@ -5,13 +7,59 @@ metadata:
   namespace: minio
 spec:
   name: riotpiao-models
-  # Bucket versioning for LLM model artifacts
   versioning:
     enabled: true
   tags:
     app: ollama
     layer: applications
     purpose: model-storage
+
 ---
-# Future: Add more buckets as needed
-# Example: terraform-state, logs, artifacts, etc.
+# Policies: define access scopes
+apiVersion: minio.min.io/v1alpha1
+kind: Policy
+metadata:
+  name: policy-ollama
+  namespace: minio
+spec:
+  name: policy-ollama
+  statements:
+    - Effect: Allow
+      Action:
+        - s3:GetObject
+        - s3:PutObject
+      Resource:
+        - arn:aws:s3:::riotpiao-models/*
+    - Effect: Allow
+      Action:
+        - s3:ListBucket
+      Resource:
+        - arn:aws:s3:::riotpiao-models
+
+---
+# Users: service accounts with scoped access
+apiVersion: minio.min.io/v1alpha1
+kind: User
+metadata:
+  name: user-ollama
+  namespace: minio
+spec:
+  accessKey: ollama-access-key
+  secretKey: ollama-secret-key-changeme  # Override via Secret
+  policies:
+    - policy-ollama
+  status: enabled
+  memberOf: []
+
+---
+# Future buckets
+# - terraform-state: for Terraform state
+# - logs: for application logs
+# - artifacts: for CI/CD artifacts
+# - backups: for database backups
+
+# Future users
+# - terraform: read/write terraform-state
+# - logging: write logs
+# - ci-cd: write artifacts
+# - backups: write backups