Make the image bucket private

The bucket carried an anonymous download policy, which is what made the
old unauthenticated proxy work. Now that images are served through a
session-gated route using credentials, anonymous access is unnecessary
and was the second half of the public exposure.

Applied on the running host; both compose files updated so bringing the
stack up elsewhere does not re-apply 'download'.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.prod.yml

@@ -50,7 +50,7 @@ services:
       /bin/sh -c "
       mc alias set local http://localhost:9000 $$MINIO_ACCESS_KEY $$MINIO_SECRET_KEY;
       mc mb local/drink-images --ignore-existing;
-      mc anonymous set download local/drink-images;
+      mc anonymous set none local/drink-images;
       exit 0;
       "