[miki3421]

Existing deployments and restored filer data can retain the legacy global anonymous Read grant. Reconcile anonymous permissions before publishing resumed SeaweedFS ingress, then read back the persisted IAM policy and reject missing, malformed or broader-than-expected grants. Reconciliation reuses the configured public web-bucket allowlist and does not bootstrap buckets or reset tenant credentials.

Validation:

• 133 operator unit tests passed in the cached production dependency image with networking disabled, including 12 anonymous-access tests.
• An isolated AMD64 K3s rehearsal recovered the retained 0.1.0 archive and completed the 0.9.0 migration with Alpha and Beta: owner S3 CRUD and cleanup, anonymous private-object GET/Range denial, peer read/write denial, public web GET/Range, all five application backends, login, streaming and two real scheduled heartbeats per tenant passed.
• The two IAM functions match the code running in the tested recovery candidate. That candidate includes separate migration changes; this PR contains only the operator IAM fix and its regression tests.

The restore workflow must reconcile IAM after the final filer/IAM import and all mapped tenant definitions, before exposing services. This PR does not add a migration orchestrator. The rehearsal required a separate restore-test correction for four independently verified expired Milvus session leases; that correction is outside this PR.