feat(compose): mount mods, config and kubejs writable

Drop :ro from ./server-mods:/mods and the four kubejs source subdirs, and
add a new ./server-config:/data/config bind — mod config used to live only
inside the mc_data volume, unreachable from the host without root.

The config bind needs seeding: a bind mount shadows what is under it, so an
empty ./server-config hides the generated config and every mod falls back to
defaults. tooling/export-server-config.sh copies /data/config out of the
volume first, halting if the target is non-empty, if the container is still
running, or if the mc_data volume name is ambiguous.

Writable mounts also need the server's uid (itzg runs as 1000) to have write
access on the host dir; oxps' host user is 1002, hence MC_UID/MC_GID.

The kubejs ROOT still must not be mounted — BaseProperties.save() NPEs and
kubejs never initialises. That is about mounting the root at all, not about
the mode, so dropping :ro does not change it. It does mean kubejs writes now
land in $DISTRIBUTION_WEB_ROOT as uncommitted changes in that host's checkout.

Also documents how to reach the mc_data volume (exec/cp, resolved host path,
stop-before-write rule) in plan/05-minecraft.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -14,6 +14,11 @@ filestash/config.json
 # tooling/sync-server-mods.sh (source of truth is mods-sides.json + $DIST jars)
 server-mods/
 
+# mod configs, seeded out of the mc_data volume by tooling/export-server-config.sh
+# and then bind-mounted rw at /data/config. Host-specific runtime state (cochi and
+# oxps diverge), regenerated by the mods themselves — not a source of truth.
+server-config/
+
 # vendored binaries
 launcher/