Validate S3 bucket public-access block during credential setup

[ANURA4G]

Problem: No check that user-provided bucket blocks public access — a misconfiguration could expose medical data.

Tasks:

• Call get-bucket-policy-status / get-public-access-block on setup
• Reject/warn if public access is not fully blocked
• Document required bucket policy in README