fix(compose): mark create-buckets as one-shot for up --wait

Closes #510.

`docker compose up -d --wait` exits 1 even when every service is
healthy because the one-shot `create-buckets` exits 0 and --wait
expects "running". The whole stack came up fine on staging, but the
workflow gate failed before the smoke step could run.

Two changes:

1. create-buckets: `restart: "no"` declares one-shot intent.
2. backend.depends_on: add `create-buckets: service_completed_successfully`.

With both, compose v2.20+ understands create-buckets is a one-shot
that must complete successfully, and --wait treats exited(0) as the
target state. Backend startup now also correctly gates on bucket
bootstrap (closes a latent race where backend could start before
the archiv-app policy was bound).

Verified `docker compose config --quiet` parses and the resolved
config shows the right dependency graph.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -86,6 +86,10 @@ services:
     # runner container's CWD. See #506 + infra/minio/Dockerfile.
     build:
       context: ./infra/minio
+    # Declare one-shot intent so `docker compose up -d --wait` treats
+    # exited(0) as success rather than "not running, fail". Pair with
+    # backend's `service_completed_successfully` dependency below. See #510.
+    restart: "no"
     depends_on:
       minio:
         condition: service_healthy
@@ -160,6 +164,12 @@ services:
         condition: service_healthy
       ocr-service:
         condition: service_healthy
+      # Gate startup on the bucket bootstrap. Without this, backend
+      # starts in parallel with create-buckets and may race the policy
+      # bind. Also tells compose's `up -d --wait` that create-buckets
+      # is a one-shot that must complete successfully. See #510.
+      create-buckets:
+        condition: service_completed_successfully
     # Bound to localhost only — Caddy fronts external traffic.
     ports:
       - "127.0.0.1:${PORT_BACKEND}:8080"