Fix worker MinIO endpoint to omit default port from signed Host header

s3.octoturge.com normalizes an explicit :443/:80 out of the Host header
before validating SigV4, so including it caused SignatureDoesNotMatch
even with correct credentials.

worker/src/main.rs

@@ -24,11 +24,19 @@ async fn main() -> anyhow::Result<()> {
     } else {
         "http"
     };
-    let minio_endpoint = format!(
-        "{minio_scheme}://{}:{}",
-        std::env::var("MINIO_ENDPOINT").unwrap_or_else(|_| "minio".into()),
-        std::env::var("MINIO_PORT").unwrap_or_else(|_| "9000".into()),
-    );
+    let minio_host = std::env::var("MINIO_ENDPOINT").unwrap_or_else(|_| "minio".into());
+    let minio_port = std::env::var("MINIO_PORT").unwrap_or_else(|_| "9000".into());
+    // Omit the port when it's the scheme's default — an explicit ":443"/":80" in the endpoint
+    // gets baked into the SigV4-signed Host header, and some S3-compatible gateways (confirmed
+    // against s3.octoturge.com) normalize the port away before validating the signature,
+    // producing SignatureDoesNotMatch even with a correct access/secret key.
+    let is_default_port = (minio_scheme == "https" && minio_port == "443")
+        || (minio_scheme == "http" && minio_port == "80");
+    let minio_endpoint = if is_default_port {
+        format!("{minio_scheme}://{minio_host}")
+    } else {
+        format!("{minio_scheme}://{minio_host}:{minio_port}")
+    };
     let minio_access_key = std::env::var("MINIO_ACCESS_KEY").unwrap_or_else(|_| "mcmapper".into());
     let minio_secret_key =
         std::env::var("MINIO_SECRET_KEY").unwrap_or_else(|_| "mcmapper-dev-only".into());