feat(compose): mount mods, config and kubejs writable

Drop :ro from ./server-mods:/mods and the four kubejs source subdirs, and
add a new ./server-config:/data/config bind — mod config used to live only
inside the mc_data volume, unreachable from the host without root.

The config bind needs seeding: a bind mount shadows what is under it, so an
empty ./server-config hides the generated config and every mod falls back to
defaults. tooling/export-server-config.sh copies /data/config out of the
volume first, halting if the target is non-empty, if the container is still
running, or if the mc_data volume name is ambiguous.

Writable mounts also need the server's uid (itzg runs as 1000) to have write
access on the host dir; oxps' host user is 1002, hence MC_UID/MC_GID.

The kubejs ROOT still must not be mounted — BaseProperties.save() NPEs and
kubejs never initialises. That is about mounting the root at all, not about
the mode, so dropping :ro does not change it. It does mean kubejs writes now
land in $DISTRIBUTION_WEB_ROOT as uncommitted changes in that host's checkout.

Also documents how to reach the mc_data volume (exec/cp, resolved host path,
stop-before-write rule) in plan/05-minecraft.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

plan/08-tooling.md

@@ -13,6 +13,7 @@ Surviving scripts:
 - `classify-mods.py` — read each jar's `neoforge.mods.toml`, seed `mods-sides.json` (see 04-mods.md)
 - `sync-server-mods.sh` — copy `both`/`server` jars from the distribution → `./server-mods` (see 04-mods.md)
 - `build-modlist.py` — generate the landing `mods.json` + extract logos (see 17-mod-shortlist.md)
+- `export-server-config.sh` — seed `./server-config` from `mc_data:/data/config` before the rw bind mount takes over (once per host, see 05-minecraft.md)
 - `render-nginx.sh` — render/install the host nginx vhost (TLS terminator → caddy)
 - `issue-letsencrypt.sh` — issue LE certs via OVH DNS-01 (see 15-letsencrypt.md)
 - `fetch-launcher.sh` — download Fjord launcher release assets (see 06-launcher.md)
@@ -68,6 +69,15 @@ Downloads FjordLauncherUnlocked release assets → `launcher/<tag>/` and maintai
 a `latest` symlink + stable per-OS filename symlinks. Full script in
 `06-launcher.md`.
 
+## export-server-config.sh
+
+One-shot, **once per host**. Copies `/data/config` out of the `mc_data` volume
+into `./server-config` so the rw bind mount `./server-config:/data/config` does
+not shadow the mod configs the server already generated. Halts if the target is
+non-empty, if the `minecraft` container is still running, or if the `mc_data`
+volume name is ambiguous. Chowns the result to `MC_UID`/`MC_GID` (default
+`1000:1000`; `oxps` needs `1002`). See `05-minecraft.md`.
+
 ## Generated / gitignored
 
 ```
@@ -76,6 +86,8 @@ nmsr/config.toml              # rendered
 launcher/                     # launcher assets
 www/                          # landing build output
 certs/                        # Let's Encrypt certs
+server-mods/                  # synced from the distribution
+server-config/                # exported from mc_data, then bind-mounted rw
 .env                          # secrets + host-specific
 ```