Merge branch 'develop' into fix/helmet-csp-and-docker-socket-diagnosis

docker-entrypoint.sh

@@ -65,6 +65,32 @@ if [ "$(id -u)" = '0' ]; then
     # Replace this shell process with su-exec so that Node becomes PID 1 and
     # receives SIGTERM/SIGINT directly from Docker. su-exec calls getgrouplist()
     # for named users, so all supplementary groups set above are inherited.
+# If running as root (the default Docker container start), fix volume ownership
+# then drop privileges before executing the application.
+#
+# This handles the common case where the host-mounted data volume was created by
+# root (or a different UID) from a previous run or backup restore — causing
+# SQLITE_READONLY errors when the non-root sencho user tries to write.
+#
+# This is the industry-standard pattern used by the official PostgreSQL, Redis,
+# and MariaDB Docker images.
+#
+# The UID guard also ensures compatibility with strict environments like
+# Kubernetes (runAsNonRoot: true) or OpenShift, where the container is forced to
+# run as a random high UID. In that case the chown block is skipped entirely and
+# the app exec's directly without crashing.
+if [ "$(id -u)" = '0' ]; then
+    mkdir -p "$DATA_DIR"
+
+    # Fix files where user OR group is wrong — not just user. This covers the
+    # case where a file ends up as sencho:root after a partial previous fix.
+    # The -exec '{}' + form batches arguments for efficiency (like xargs).
+    find "$DATA_DIR" \( \! -user sencho -o \! -group sencho \) \
+        -exec chown sencho:sencho '{}' +
+
+    # Replace this shell process with su-exec so that Node becomes PID 1 and
+    # receives SIGTERM/SIGINT directly from Docker. Without exec the shell would
+    # intercept signals and the container would hang for 10s before SIGKILL.
     exec su-exec sencho "$@"
 fi