fix(backend): chown the firmware blob volume to 65534 before the writers start (A20)

A fresh named `fwblobs` volume is created root-owned (0:0, 0755), but ingest and
admin run as 65534 (nobody) — so the admin firmware register could not write the
blob (CreateTemp -> permission denied -> the crash-safe path left a row pointing at
a missing blob, a 500). The Go e2e gate missed this: RegisterFirmware wrote to a
root-owned t.TempDir(); only the LIVE deploy surfaced it (empirie-vor-behauptung).

Fix: a `fwblobs-init` one-shot (alpine, root) chowns the volume to 65534 before
ingest/admin start (depends_on: service_completed_successfully), mirroring the
`migrate` one-shot pattern. Idempotent + fast on restart; reproducible on any host /
fresh volume (a one-off host chown would silently break on volume recreation).

Verified on the live deploy: admin firmware register -> 200, the content-addressed
blob lands on the volume, duplicate -> 409, sha-mismatch -> 422. Serving stays dark
(OTA_SERVE_ENABLED=false). Follow-up to the A20 merge (5dfa677).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: GottZ

backend/docker-compose.yml

@@ -63,6 +63,17 @@ services:
     networks: [internal]
     restart: "no"
 
+  # one-shot: a fresh named volume is created root-owned (0:0, 0755), but ingest/admin run as 65534
+  # (nobody) — without this the admin firmware register cannot write the blob. chown the volume to
+  # 65534 before the writers start; idempotent + fast on restart. A20 §4.7.
+  fwblobs-init:
+    image: alpine:3
+    command: ["chown", "-R", "65534:65534", "/fwblobs"]
+    volumes:
+      - fwblobs:/fwblobs
+    networks: [internal]
+    restart: "no"
+
   grafana:
     image: grafana/grafana:11.3.0
     depends_on:
@@ -90,6 +101,8 @@ services:
         condition: service_healthy
       migrate:
         condition: service_completed_successfully
+      fwblobs-init:
+        condition: service_completed_successfully
     environment:
       POSTGRES_DB: ${POSTGRES_DB:-picpak}
       POSTGRES_USER: ${POSTGRES_USER:-picpak}
@@ -128,6 +141,8 @@ services:
         condition: service_healthy
       migrate:
         condition: service_completed_successfully
+      fwblobs-init:
+        condition: service_completed_successfully
     environment:
       POSTGRES_DB: ${POSTGRES_DB:-picpak}
       POSTGRES_USER: ${POSTGRES_USER:-picpak}