feat(files): run filestash as a chosen uid so share files are host-owned

Add an env-driven `user:`/`group_add` to the filestash service plus
tooling/filestash-set-run-user.sh. Running the container as a real host
account (oxps: oier=1002) makes every file it writes into the share owned
by that account, so scp/ssh and the web UI share one owner — no chown dance.

Defaults FILES_UID/FILES_GID=1000, leaving cochi (image's own uid) untouched.
group_add 1000 keeps the 0730 image binary + 0770 /app/data usable under any
uid; the helper also chowns the filestash_state volume (1000:1000) so a
non-1000 uid doesn't crash-loop unable to write its own sqlite/config.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -257,6 +257,18 @@ services:
     image: machines/filestash@sha256:8cb09d42470328a02aec6e3861f912addf8a9d54ad63d9c965bcb48df5ad36b1
     container_name: filestash
     restart: unless-stopped
+    # Runtime uid/gid of the filestash process. Default 1000:1000 = the image's
+    # own `filestash` user (cochi runs this — files in the share end up 1000).
+    # A host can override so share files are owned by a host account instead
+    # (oxps: FILES_UID/FILES_GID=1002 → files owned by `oier`). When overriding
+    # to a non-1000 uid you MUST also chown the filestash_state volume + the
+    # FILES_DATA_DIR share to that uid — see plan/20-files.md. group_add keeps
+    # the image binary (/app/filestash is 0730, group filestash) executable and
+    # /app/data (0770) traversable no matter which uid runs; on cochi it is the
+    # process's own gid, harmlessly redundant.
+    user: "${FILES_UID:-1000}:${FILES_GID:-1000}"
+    group_add:
+      - "1000"
     environment:
       # The `local` storage backend is admin-gated in filestash: it refuses to
       # init unless the connection params carry this secret (or the admin