fix(minio): use configuration secret (config.env) for root creds, valid image tag — tenant now boots and authenticates

Switch Tenant from credsSecret to configuration field (v5 pods read config.env
shell exports); pin image to RELEASE.2025-07-23 (the old 2024-06 tag was pulled
from Docker Hub, ErrImagePull); drop prometheusOperator:true (made operator fail
reconcile hunting Prometheus in ns default). MinIO now serves S3, 4/4 drives OK,
root auth works. Operator's cosmetic 'empty tenant credentials' health-log is
harmless (documented inline).

k8s/infrastructure/minio/minio-tenant.yaml

@@ -11,11 +11,14 @@ metadata:
     prometheus.io/port: "9000"
     prometheus.io/scrape: "true"
 spec:
-  image: minio/minio:RELEASE.2024-06-13T20-48-48Z
+  image: minio/minio:RELEASE.2025-07-23T15-54-02Z
 
-  # Root credentials (rootUser/rootPassword). Created out-of-band — see
-  # BOOTSTRAP.md / SOPS. Operator reads CONSOLE_ACCESS_KEY style from here.
-  credsSecret:
+  # Root credentials. v5 pods read `configuration` — a Secret whose `config.env`
+  # key holds shell `export MINIO_ROOT_USER=...` lines. Created out-of-band
+  # (SOPS), see minio-secrets.enc.yaml. NOTE: the operator health-monitor logs a
+  # cosmetic "empty tenant credentials" warning (it greps for legacy
+  # access_key/secret_key keys) — MinIO itself authenticates fine; ignore it.
+  configuration:
     name: minio-creds
 
   # ── Single pool on the sole storage/scheduling node (talos-cp-1, az-a) ──────
@@ -69,8 +72,10 @@ spec:
   users:
     - name: minio-user-ollama
 
-  # Expose ServiceMonitor for the kube-prometheus-stack.
-  prometheusOperator: true
+  # Metrics are exposed at /minio/v2/metrics; scrape via a hand-rolled
+  # ServiceMonitor in the monitoring stack rather than operator auto-wiring
+  # (prometheusOperator:true makes the operator hunt for Prometheus in ns
+  # 'default' and fail the reconcile).
 
   # Public hostnames the tenant serves (S3 + console via the cluster ingress).
   features: