feat(youko): replace MinIO with RustFS S3

Deploy RustFS in place of the retired MinIO and move the S3 consumers over.

- flake.nix / flake.lock / outputs/default.nix: add a nixpkgs-small
  (nixos-unstable-small) input for the rustfs 1.0.0 package (with the web
  console), instantiated as pkgs-small in genSpecialArgs alongside the other
  nixpkgs instances; drop the rustfs flake input. The rest of the system stays
  on the default nixpkgs.
- hosts/12kingdoms-youko/homelab-services/rustfs.nix: use nixpkgs' own
  services.rustfs module, with package = pkgs-small.rustfs and
  environmentFile = the agenix rustfs.env secret.
- caddy.nix: s3.writefor.fun (S3 API) and s3-console.writefor.fun (console,
  redirects / to /rustfs/console/).
- secrets/nixos.nix: declare a single rustfs.env (dotenv) secret holding
  RUSTFS_ACCESS_KEY / RUSTFS_SECRET_KEY, replacing the separate key files.
- infra/minio -> infra/rustfs: buckets are managed with the hashicorp/aws
  provider against the RustFS S3 endpoint; IAM/ILM are applied with rc.

outputs/default.nix

@@ -69,6 +69,12 @@ let
         # to use chrome, we need to allow the installation of non-free software
         config.allowUnfree = true;
       };
+      # only for rustfs: nixos-unstable-small ships rustfs 1.0.0 (with the web
+      # console), while the default unstable nixpkgs is still 1.0.0-rc.6.
+      pkgs-small = import inputs.nixpkgs-small {
+        inherit system;
+        config.allowUnfree = true;
+      };
       pkgs-blender = import inputs.nixpkgs-blender {
         inherit system;
         config = lib.optionalAttrs (system == "x86_64-linux") {