fix: run container as host PUID/PGID for workspace mounts

node uid 1000 could not read /home/frank (frank=1002); build and compose now use configurable PUID/PGID.

Co-authored-by: Cursor <cursoragent@cursor.com>

DEPLOY.md

@@ -19,15 +19,18 @@ cd /home/frank/pi.schwenk.online
 
 cp .env.example .env
 # edit OPENROUTER_API_KEY
-# set WORKSPACE_HOST_PATH to the host dirs Pi should edit, e.g. /home/frank
+# PUID/PGID = host user (frank on boka: 1002) — must match `id -u` / `id -g`
+# WORKSPACE_HOST_PATH=/home/frank
 
-mkdir -p data/pi-web data/pi-agent workspaces
-# Container runs as uid 1000 (node); fix ownership if needed:
-sudo chown -R 1000:1000 data workspaces
+mkdir -p data/pi-web data/pi-agent
+chown -R "$(id -u):$(id -g)" data
 
 docker compose build
 docker compose up -d
 docker compose logs -f --tail=100
+
+# smoke: should list your projects, not Permission denied
+docker compose exec web ls /workspaces/eselhoefe.de
 ```
 
 ## Verify
@@ -56,3 +59,4 @@ docker compose build --no-cache && docker compose up -d
 - No host port publish; only Traefik on network `traefik` reaches `:8504`
 - Middleware is referenced only (`authelia@docker`); ForwardAuth is defined on Authelia
 - `pi-coding-agent` pinned to `0.82.1` for current `pi-web` peer range
+- Container runs as `PUID`/`PGID` (default 1002) so bind mounts under `/home/frank` are readable