feat(files): run filestash as a chosen uid so share files are host-owned

Add an env-driven `user:`/`group_add` to the filestash service plus
tooling/filestash-set-run-user.sh. Running the container as a real host
account (oxps: oier=1002) makes every file it writes into the share owned
by that account, so scp/ssh and the web UI share one owner — no chown dance.

Defaults FILES_UID/FILES_GID=1000, leaving cochi (image's own uid) untouched.
group_add 1000 keeps the 0730 image binary + 0770 /app/data usable under any
uid; the helper also chowns the filestash_state volume (1000:1000) so a
non-1000 uid doesn't crash-loop unable to write its own sqlite/config.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -63,6 +63,15 @@ FILES_DATA_DIR=/srv/ulicraft-files
 # value is substituted straight into the volume string.
 FILES_MOUNT_MODE=rw
 
+# Runtime uid:gid of the filestash process (docker `user:`). Leave at the image
+# default 1000:1000 UNLESS you want files it writes into the share owned by a
+# host account. To own the share as `oier` on oxps: set both to 1002 and run
+# tooling/filestash-set-run-user.sh (it chowns the state volume + share to match
+# — a bare override without the chown makes filestash fail to write its sqlite).
+# The compose keeps group_add 1000 so any uid can still exec the image binary.
+FILES_UID=1000
+FILES_GID=1000
+
 # Auth middleware (rendered into config.json by render-config.sh):
 #   htpasswd    one shared user/pass — the only internet-safe value
 #   passthrough NO LOGIN. Anyone reaching the vhost is in.