Phase 1: chunk store, tile rendering pipeline, and Leaflet viewer

api: WS gateway with token auth (Postgres-backed servers table, seeded via
`bun run seed`), column-granularity chunk store (hand-written SQL
migrations, no drizzle-kit CLI — its config loader needs esbuild, which
doesn't install cleanly here), dirty-chunk Redis stream producer with
per-flush dedup, and a tile-serving route.

worker: consumes the dirty-chunk stream via a proper consumer group,
rasterizes each chunk's columns into a single-resolution top-down PNG
(static pre-Flattening block-id palette), uploads to MinIO, and upserts
the tile pointer.

frontend: barebones Leaflet 2D viewer (CRS.Simple, one native zoom level)
wired to /api/servers and /api/tiles.

Object storage: tiles live in a dedicated `mcmapper-tiles` bucket on the
existing shared MinIO instance (devstack-minio on octo-winsrv) instead of
a per-stack container, via a scoped access key limited to that one bucket
— see README's "Object storage" section. MINIO_SECRET_KEY is real and is
deliberately not committed; docker-compose layers an untracked .env over
.env.example for it.

Full pipeline verified end-to-end against live containers: WS auth ->
Postgres upsert -> deduped Redis dirty-chunk event -> worker rasterize ->
MinIO upload -> tile fetch through the api route, including from the
actual mod-side WS client (see MCMapper-Mod's matching commit).

docker-compose.yml

@@ -1,11 +1,15 @@
 services:
   api:
     build: ./api
-    env_file: ./api/.env.example
+    # .env.example holds safe defaults (committed); an untracked ./api/.env layered on top
+    # supplies real secrets (MINIO_SECRET_KEY) — see api/.env.example.
+    env_file:
+      - ./api/.env.example
+      - path: ./api/.env
+        required: false
     depends_on:
       - postgres
       - redis
-      - minio
     expose:
       - "3000"
     restart: unless-stopped
@@ -21,11 +25,13 @@ services:
 
   worker:
     build: ./worker
-    env_file: ./worker/.env.example
+    env_file:
+      - ./worker/.env.example
+      - path: ./worker/.env
+        required: false
     depends_on:
       - postgres
       - redis
-      - minio
     restart: unless-stopped
     # Scale render capacity locally with, e.g.: docker compose up --scale worker=3
     # A `worker` can also run standalone on a separate machine, pointed at the same
@@ -50,18 +56,10 @@ services:
     restart: unless-stopped
     # Same rule as postgres: no public ports.
 
-  minio:
-    image: minio/minio:latest
-    command: server /data --console-address ":9001"
-    environment:
-      MINIO_ROOT_USER: mcmapper
-      MINIO_ROOT_PASSWORD: mcmapper-dev-only
-    volumes:
-      - minio-data:/data
-    restart: unless-stopped
-    # Same rule as postgres/redis: no public ports in production. The console (9001) and
-    # S3 API (9000) are reachable on the compose network for api/worker; expose to your
-    # private network only, same as postgres/redis, if you need the console remotely.
+  # No `minio` service here: rendered tiles/meshes are stored in a dedicated bucket
+  # (`mcmapper-tiles`) on an existing shared MinIO instance instead of a per-stack container —
+  # see api/.env.example and worker/.env.example for the endpoint/credentials, and README.md
+  # for how that bucket + scoped access key were provisioned.
 
   caddy:
     image: caddy:2-alpine
@@ -79,5 +77,4 @@ services:
 volumes:
   postgres-data:
   redis-data:
-  minio-data:
   caddy-data: