sync: update from private repo (10f4905)

Dockerfile

@@ -64,15 +64,20 @@ COPY --from=builder /app/vendor ./vendor
 COPY pieces ./pieces
 COPY docs ./docs
 
-# Ship a runnable default while still allowing a read-only config mount.
+# Ship a runnable default while still allowing a config bind-mount.
 COPY config.yaml.example ./config.yaml
 
-RUN mkdir -p /data /workspaces \
-    && chown -R node:node /data /workspaces
+# The app runs as the non-root `node` user and writes its state under ./data
+# (db, users, skills, secrets) — relative to WORKDIR /app, i.e. /app/data — plus
+# /workspaces (worktree) and config.yaml (Settings save). Create and own those
+# so a fresh deploy doesn't hit EACCES. /app/data and /workspaces are the volume
+# mount points in docker-compose.
+RUN mkdir -p /app/data /workspaces \
+    && chown -R node:node /app/data /workspaces config.yaml
 
 ENV NODE_ENV=production \
     PORT=9876 \
-    DB_PATH=/data/maestro.db
+    DB_PATH=/app/data/maestro.db
 
 EXPOSE 9876