fix(entrypoint): stop chmod -R 755 on the customer home every start

entrypoint.sh ran `chmod -R 755 /home/$user` on every container start.
/home/$user is the customer's bind-mounted directory, so every file (.env and
other app secrets included) became world-readable and executable, and any
tighter permissions the customer set were reverted on each restart. It dates
from the initial implementation (2989cd5) with no stated reason; the same
pattern was removed from cloud-apache-container.

The legitimate need: nginx workers run as `nginx` (configs/nginx.conf) and
serve /static/ via `alias /home/$user/app/public/`, so nginx must traverse
directories. Keep the recursive chown; replace the recursive chmod with
chmod 755 on /home/$user itself and o+x on directories lacking it. Regular
files are never touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/entrypoint.sh

@@ -32,7 +32,16 @@ ln -s /home/$user/logs/nodejs /var/log/nodejs
 
 # Set ownership and permissions
 chown -R $user:$user /home/$user
-chmod -R 755 /home/$user
+# Do NOT `chmod -R 755` here. /home/$user is the customer's bind-mounted
+# directory; a recursive 755 on every start made every file (.env, app
+# secrets) world-readable AND executable, and reverted any tighter
+# permissions the customer had set. nginx workers run as `nginx` (not the
+# customer) and serve /static/ straight from /home/$user/app/public/, so they
+# only need to traverse directories. Normalise that and nothing else: open the
+# home dir itself (adduser -m creates it 0700 when it does not exist yet), and
+# add o+x to directories that lack it. Regular files are never touched.
+chmod 755 /home/$user
+find /home/$user -type d ! -perm -o=x -exec chmod o+x {} +
 
 # Start nginx
 nginx