Production still set MAGPIE_PUBLIC_BUCKETS=app-uploads, but only
MAGPIE_PUBLIC_PREFIXES was read, so media.elektrine.com returned
SignatureDoesNotMatch 403. Accept bare bucket public reads and the
legacy PUBLIC_BUCKETS env.
Add scripts/deploy.sh to build/start Magpie and ensure it joins
elektrine-magpie-shared (alias magpie) so Elektrine can reach magpie:8090.
Forgejo Actions rsyncs and runs the script on every main push.