fix: append S3 env vars if missing instead of silent sed no-op

The deploy script used sed substitution for S3_ACCESS_KEY, S3_SECRET_KEY,
and S3_BUCKET, which silently does nothing when the lines don't exist in
deploy/.env. This happens when the .env was created before S3 vars were
added to the template. Now uses grep-or-append pattern to ensure vars
are always present. Also adds S3_ENDPOINT which was never injected.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: baijum

infrastructure/deploy-blue-green.sh

@@ -109,9 +109,22 @@ if [ -f "$CREDENTIALS_FILE" ]; then
   # shellcheck source=/dev/null
   source "$CREDENTIALS_FILE"
   sed -i "s|^DATABASE_URL=.*|DATABASE_URL=postgresql://${DB_USER}:${DB_PASSWORD}@postgres:5432/${APP_DB}|" deploy/.env
-  sed -i "s|^S3_ACCESS_KEY=.*|S3_ACCESS_KEY=${S3_ACCESS_KEY}|" deploy/.env
-  sed -i "s|^S3_SECRET_KEY=.*|S3_SECRET_KEY=${S3_SECRET_KEY}|" deploy/.env
-  sed -i "s|^S3_BUCKET=.*|S3_BUCKET=${APP_NAME}-uploads|" deploy/.env
+
+  # Ensure S3 vars exist (append if missing, substitute if present)
+  if [ -n "${S3_ACCESS_KEY:-}" ]; then
+    grep -q "^S3_ENDPOINT=" deploy/.env \
+      && sed -i "s|^S3_ENDPOINT=.*|S3_ENDPOINT=http://minio:9000|" deploy/.env \
+      || echo "S3_ENDPOINT=http://minio:9000" >> deploy/.env
+    grep -q "^S3_ACCESS_KEY=" deploy/.env \
+      && sed -i "s|^S3_ACCESS_KEY=.*|S3_ACCESS_KEY=${S3_ACCESS_KEY}|" deploy/.env \
+      || echo "S3_ACCESS_KEY=${S3_ACCESS_KEY}" >> deploy/.env
+    grep -q "^S3_SECRET_KEY=" deploy/.env \
+      && sed -i "s|^S3_SECRET_KEY=.*|S3_SECRET_KEY=${S3_SECRET_KEY}|" deploy/.env \
+      || echo "S3_SECRET_KEY=${S3_SECRET_KEY}" >> deploy/.env
+    grep -q "^S3_BUCKET=" deploy/.env \
+      && sed -i "s|^S3_BUCKET=.*|S3_BUCKET=${APP_NAME}-uploads|" deploy/.env \
+      || echo "S3_BUCKET=${APP_NAME}-uploads" >> deploy/.env
+  fi
   info "deploy/.env updated with per-app credentials"
 else
   warn "Per-app credentials not found at $CREDENTIALS_FILE"