fix(infra): remove anonymous public read access from MinIO bucket

[MinitJain]

Summary

• minio-setup container ran mc anonymous set download capminio/cap on startup, making the entire S3 bucket publicly readable at the network level
• Removed this line from both docker-compose.yml and docker-compose.coolify.yml
• All video access already goes through the application's presigned URL flow — no functionality change

Security Impact

With anonymous bucket access set, anyone who could reach port 9000 on the host could download any stored file directly (videos, audio, thumbnails) without authentication — bypassing all app-level access controls including private videos, password protection, and org membership checks. Presigned URLs are signed by the S3 credentials and do not require the bucket to be public.

Test plan

• Fresh docker compose up — bucket created, no anonymous policy set
• Video upload and playback still works via presigned URLs
• Direct unauthenticated GET to http://localhost:9000/cap/<path> returns 403

Greptile Summary

This PR removes the mc anonymous set download command from the minio-setup container in both docker-compose variants, closing a misconfiguration that made the entire storage bucket publicly readable at the network level. File access continues to work via the existing presigned URL flow, which does not require an open bucket policy.

• docker-compose.yml: Drops the anonymous download policy line from the local development setup.
• docker-compose.coolify.yml: Applies the same removal to the Coolify production deployment variant.

Confidence Score: 5/5

Safe to merge — the change removes a two-line misconfiguration with no functional impact on the presigned-URL access path.

Both files delete a single mc anonymous set download command and nothing else. The application's video/file access already routes through presigned URLs, so removing bucket-level public access has no effect on legitimate usage. The change is minimal and the risk of regression is very low.

No files require special attention.

Important Files Changed

Filename	Overview
docker-compose.yml	Removes mc anonymous set download capminio/cap from the minio-setup startup script, eliminating anonymous public read access to the bucket.
docker-compose.coolify.yml	Removes mc anonymous set download capminio/${S3_BUCKET:-cap} from the minio-setup startup script, mirroring the fix in docker-compose.yml for the Coolify deployment variant.

_{Reviews (2): Last reviewed commit: "Merge remote-tracking branch 'upstream/m..." | Re-trigger Greptile}

[richiemcilroy]

please review the pr @greptileai