Add optional MinIO compose profile for upload testing

\`docker compose --profile s3 up\` brings up a MinIO container plus a
one-shot minio/mc sidecar that pre-creates the \`cohorts-binaries\`
bucket. Plain \`docker compose up\` is unchanged. The S3 API is only
reachable inside the compose network at \`http://s3:9000\`; the admin
console is forwarded at http://localhost:59001 (cohorts/cohortscohorts).

Verified:
- plain up: 2 services (db, app), no MinIO
- --profile s3 up: 4 services; bucket auto-created
- boto3 upload from the app container lands in the bucket
- host :9001 console reachable, host :9000 not forwarded

Author: aveao

README.md

@@ -28,6 +28,28 @@ docker compose exec app uv run flask import_json  # one-shot seed from config.js
 
 The API is exposed on http://localhost:5000. Postgres data persists in the `cohorts-pg-data` named volume, run `docker compose down -v` if you want a fresh database.
 
+### Optional: fake S3 for upload testing
+
+The `s3` compose profile brings up a local MinIO container plus a one-shot sidecar that pre-creates a `cohorts-binaries` bucket, so the `fetch_firmware` upload path can be exercised without real S3 credentials:
+
+```
+docker compose --profile s3 up -d
+```
+
+Admin console at http://localhost:59001 (user `cohorts`, pass `cohortscohorts`). The S3 API itself is only reachable from inside the compose network at `http://s3:9000` — it is not forwarded to the host.
+
+To point `fetch_firmware` at it, export the matching env on the host before bringing the stack up (or `docker compose --profile s3 restart app` to pick up changes), then run the command as usual:
+
+```
+export AWS_ACCESS_KEY=cohorts AWS_SECRET_KEY=cohortscohorts
+export S3_BUCKET=cohorts-binaries S3_ENDPOINT=http://s3:9000
+export MEMFAULT_TOKEN=<your key>
+docker compose --profile s3 restart app
+docker compose --profile s3 exec app uv run flask fetch_firmware
+```
+
+The MinIO bucket contents persist in the `cohorts-s3-data` named volume — `docker compose down -v` clears them along with Postgres.
+
 ## Firmware data
 
 Firmware rows live in the `firmwares` table, keyed by `(hardware, kind, version)`. Multiple versions per `(hardware, kind)` are allowed so rollback works by submitting an older version with a newer timestamp — `/cohort?select=fw` always returns the latest row per requested kind by `timestamp` descending.

docker-compose.yaml

@@ -37,5 +37,37 @@ services:
         condition: service_healthy
     command: sh -c "uv run flask db upgrade && uv run python serve_debug.py"
 
+  # Optional: `docker compose --profile s3 up` brings up a local S3-compatible
+  # MinIO plus a one-shot sidecar that creates the `cohorts-binaries` bucket.
+  # The S3 API is reachable inside the compose network at http://s3:9000 and
+  # is intentionally not forwarded to the host; the admin console is forwarded
+  # at http://localhost:59001.
+  s3:
+    image: minio/minio:latest
+    profiles: ["s3"]
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: cohorts
+      MINIO_ROOT_PASSWORD: cohortscohorts
+    ports:
+      - "59001:9001"
+    volumes:
+      - cohorts-s3-data:/data
+
+  s3-init:
+    image: minio/mc:latest
+    profiles: ["s3"]
+    depends_on:
+      - s3
+    entrypoint: >
+      sh -c "
+        until mc alias set local http://s3:9000 cohorts cohortscohorts >/dev/null 2>&1; do sleep 1; done;
+        mc mb --ignore-existing local/cohorts-binaries;
+        mc anonymous set download local/cohorts-binaries;
+        echo 'bucket ready: cohorts-binaries';
+      "
+    restart: "no"
+
 volumes:
   cohorts-pg-data:
+  cohorts-s3-data: