security: restrict MinIO app to one bucket

apps/api/app/storage.py

@@ -6,7 +6,6 @@ from functools import lru_cache
 
 import boto3
 from botocore.client import BaseClient
-from botocore.exceptions import ClientError
 from PIL import Image, UnidentifiedImageError
 
 from .config import settings
@@ -63,10 +62,7 @@ def upload_screenshot(raw: bytes, *, filename: str | None = None, content_type:
     body, extension, mime = prepare_image(raw)
     key = f"reports/{uuid.uuid4()}.{extension}"
     s3 = client()
-    try:
-        s3.head_bucket(Bucket=settings.s3_bucket)
-    except ClientError:
-        s3.create_bucket(Bucket=settings.s3_bucket)
+    s3.head_bucket(Bucket=settings.s3_bucket)
     s3.put_object(Bucket=settings.s3_bucket, Key=key, Body=body, ContentType=mime)
     return key