Load MINIO_SECURE from env and replace adapter asserts with explicit errors.

Default TLS to enabled for production MinIO setups while keeping local and integration tests on plain HTTP via explicit secure=false configuration.

Co-authored-by: Cursor <cursoragent@cursor.com>

python_repositories/config/minio_config.py

@@ -9,6 +9,21 @@ from python_utils import check_env
 
 from python_repositories.config.dotenv_loader import load_dotenv
 
+_TRUTHY = frozenset({"1", "true", "yes", "on"})
+_FALSY = frozenset({"0", "false", "no", "off"})
+
+
+def _env_bool(name: str, default: bool) -> bool:
+    raw = os.getenv(name)
+    if raw is None:
+        return default
+    normalized = raw.strip().lower()
+    if normalized in _TRUTHY:
+        return True
+    if normalized in _FALSY:
+        return False
+    raise ValueError(f"Invalid boolean value for {name}: {raw!r}")
+
 
 @dataclass(frozen=True)
 class MinioConfig:
@@ -18,7 +33,7 @@ class MinioConfig:
     access_key: str
     secret_key: str
     bucket: str
-    secure: bool = False
+    secure: bool = True
 
     @classmethod
     def from_env(
@@ -27,6 +42,7 @@ class MinioConfig:
         access_key_env_var_name: str = "MINIO_ACCESS_KEY",
         secret_key_env_var_name: str = "MINIO_SECRET_KEY",
         bucket_env_var_name: str = "MINIO_BUCKET",
+        secure_env_var_name: str = "MINIO_SECURE",
         *,
         use_dotenv: bool = True,
     ) -> MinioConfig:
@@ -45,4 +61,5 @@ class MinioConfig:
             access_key=str(os.getenv(access_key_env_var_name)),
             secret_key=str(os.getenv(secret_key_env_var_name)),
             bucket=str(os.getenv(bucket_env_var_name)),
+            secure=_env_bool(secure_env_var_name, default=True),
         )