fix(api): create space bucket with correct policies

[ascariandrea]

Summary

Programmatic MinIO bucket creation at API startup, ensuring the bucket exists and is properly configured regardless of deployment environment.

Changes

• checkBucketOrCreate.bootstrap.ts — New bootstrap step that checks if SPACE_BUCKET exists, creates it if missing, with race-condition handling for concurrent pod startups
• space.provider.ts — Added getBucket and putBucketPolicy methods to the S3 provider interface
• local-space.provider.ts — Stub implementations for testing
• .husky/pre-push — Fixed hook to build all packages first (was skipping @liexp/backend due to private: true)

Architecture

• Bucket remains private by default; public-read is granted per-object via ACL: "public-read" in the upload flow
• Compatible with both Docker Compose (local dev) and Helm/MinIO Operator (production)
• No Helm chart changes needed — bootstrap runs inside the API pod at startup

Commits

1. fix(api): create space bucket with correct policies — Initial implementation
2. fix(api): use object ACL for public-read instead of bucket policy — Bucket stays private, public-read per-object
3. fix(workspace): build all packages before pre-push filter — Fix pre-push hook