Add MinIO Policies and Users via CRD alongside Buckets. Resources now declarative: - Bucket: riotpiao-models (versioning enabled) - Policy: policy-ollama (scoped bucket access) - User: user-ollama (service account for Ollama/LLM) Access keys can be overridden via SOPS or kustomize overlays. All MinIO resource creation now git-tracked and version controlled.