build: replace MinIO with Garage in the dev stack and CI

[PhilippTheServer]

Closes #59

minio/minio was removed from Docker Hub, so the dev stack and Run Tests with Services failed at image pull (see #58).

Changes

• docker-compose.dev.yml: opentaberna-minio → opentaberna-garage (dxflrs/garage:v2.4.1, the latest stable version). --single-node --default-access-key sets up the layout and creates the key from STORAGE_ACCESS_KEY/STORAGE_SECRET_KEY on start, so no init service is needed. The S3 API stays on host port 9000, so STORAGE_ENDPOINT_URL defaults are unchanged.
• docker/garage/garage.toml: single-node config with s3_region = "us-east-1", matching the client's default.
• GARAGE_RPC_SECRET is required from .env and not committed. CI generates a fresh one per run with openssl rand -hex 32.
• The CI readiness check uses Garage's admin /health (port 3903).
• Docs: README, .env.example, docs/config.md (also corrected the stale minioadmin / labels defaults), setting descriptions. Wiki follows in a companion PR.
• No Python code or dependency changes: the adapter already speaks plain S3 through aiobotocore.

Verification

Against a local Garage v2.4.1, the repo's MinioStorageAdapter created a bucket, ensured it again (no error), uploaded and downloaded an object:

Storage bucket created
Storage bucket already exists
Object uploaded
Object downloaded
ok http://localhost:9000/item-images/t/x.bin

Compose service healthy, and it fails clearly without the secret:

$ docker compose -f docker-compose.dev.yml up -d opentaberna-garage   # health: healthy, GET :3903/health → 200
$ docker compose -f docker-compose.dev.yml --env-file /dev/null config
required variable GARAGE_RPC_SECRET is missing a value: set GARAGE_RPC_SECRET in .env, generate one with openssl rand -hex 32

The regression check is Run Tests with Services itself: it starts Garage and the image and label integration tests go through it.

🤖 Generated with Claude Code