simplify container: skip db prep, password via env var, fixed server IP

- start.sh: remove prepara_db.py step; load S3 creds via DuckDB init file
- Caddyfile: switch to basic_auth with {env.BASIC_AUTH_HASH} — no rebuild to rotate password
- Dockerfile: drop Python/pip layers (no longer needed at runtime)
- haloy.yml: set server to 89.167.95.136, add BASIC_AUTH_HASH to env
- remove requirements.txt (only needed for local prepara_db.py, not the container)

start.sh

@@ -1,11 +1,20 @@
 #!/bin/bash
 set -euo pipefail
 
-echo "[start] Building DuckDB views from S3..."
-python3 prepara_db.py
+# DuckDB init: load S3 credentials from env at session start
+INIT=$(mktemp /tmp/duckdb_init_XXXX.sql)
+S3_ENDPOINT="${HETZNER_S3_ENDPOINT#https://}"
+S3_ENDPOINT="${S3_ENDPOINT#http://}"
+cat > "$INIT" <<SQL
+INSTALL httpfs; LOAD httpfs;
+SET s3_endpoint='${S3_ENDPOINT}';
+SET s3_access_key_id='${AWS_ACCESS_KEY_ID}';
+SET s3_secret_access_key='${AWS_SECRET_ACCESS_KEY}';
+SET s3_url_style='path';
+SQL
 
 echo "[start] Starting Caddy..."
 caddy start --config /app/Caddyfile --adapter caddyfile
 
-echo "[start] Starting DuckDB UI on :4213..."
-exec duckdb --ui basedosdados3.duckdb
+echo "[start] Starting DuckDB UI..."
+exec duckdb --ui -init "$INIT" basedosdados3.duckdb