docs(migration): fresh-world kubejs root-owned crash-loop + fix

On a fresh mc_data volume the minecraft service crash-loops with
"AccessDeniedException: /data/kubejs/config" (ConsoleJS.STARTUP null NPE):
Docker auto-creates the bind-mount parent /data/kubejs as root:root, but
the itzg container runs as uid 1000, so KubeJS can't create its writable
siblings (config/cache/generated/logs). Only bites fresh worlds — cochi's
aged volume predates the ro submounts and is already 1000-owned.

Fix (durable): chown 1000:1000 /data/kubejs once, then restart.

- plan/22-migration.md: Troubleshooting section with symptom + fix.
- migrate-import.sh: manual tail now flags it with the exact commands.

Hit + resolved during the cochi->oxps migration.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tooling/migrate-import.sh

@@ -176,6 +176,14 @@ Remaining manual steps (see plan/22-migration.md for detail):
   7. Bring it up:            ./update-all.sh --hard
   8. Re-op players once they've joined:  docker compose exec minecraft rcon-cli op <name>
 
+Fresh-world gotcha: if minecraft crash-loops on a fresh mc_data with
+  "AccessDeniedException: /data/kubejs/config" (ConsoleJS.STARTUP null), Docker
+  created /data/kubejs as root while the container runs as uid 1000. Fix once:
+     docker compose stop minecraft
+     docker run --rm -v ${PROJ}_mc_data:/data alpine chown 1000:1000 /data/kubejs
+     docker compose up -d minecraft
+  Details: plan/22-migration.md (Troubleshooting).
+
 Rollback note: same domain means DNS points at ONE host. Once a player registers
 or changes a skin here, this drasl.db diverges from cochi — rolling back to cochi
 silently loses those changes. Keep the fallback window short.