fix: ensure foundry-module dir is writable by chronicle user

The foundry-module directory was COPY'd as root in the Dockerfile and
never chown'd, so upload/redeploy operations hit "permission denied"
when running as the unprivileged chronicle user.

https://claude.ai/code/session_01XMwxFR8BCi5XvgaSVMSBZB

Author: claude

Dockerfile

@@ -66,7 +66,9 @@ COPY --from=builder /src/foundry-module /app/foundry-module
 # Create persistent data directory owned by the chronicle user.
 # Media uploads go under /app/data/media (matches MEDIA_PATH default "./data/media").
 # Mount a volume at /app/data to persist media across container rebuilds.
-RUN mkdir -p /app/data/media && chown -R chronicle:chronicle /app/data
+# foundry-module must also be writable so the admin can upload/redeploy modules.
+RUN mkdir -p /app/data/media \
+    && chown -R chronicle:chronicle /app/data /app/foundry-module
 
 WORKDIR /app
 

docker-entrypoint.sh

@@ -13,8 +13,8 @@ set -e
 
 if [ "$(id -u)" = "0" ]; then
     # Running as root: ensure dirs exist, fix ownership, drop privileges.
-    mkdir -p /app/data/media
-    chown -R chronicle:chronicle /app/data
+    mkdir -p /app/data/media /app/foundry-module
+    chown -R chronicle:chronicle /app/data /app/foundry-module
     exec su-exec chronicle "$@"
 else
     # Running as non-root (platform-enforced user).