Backup: chown /app/backups in image + report uid/writability

The real backup run failed: pg_dump could not write to /app/backups —
'Permission denied'. Cause: the container runs as the non-root 'vyndr'
user (Dockerfile USER vyndr) and the Coolify-mounted volume is
root-owned, so the mount is present but unwritable.

- Dockerfile now creates AND chowns /app/backups to vyndr alongside the
  existing /app/data + /app/.pm2 line. Docker seeds ownership into a
  NAMED volume on first creation, so this fixes it for a fresh volume;
  a host bind-mount still needs a host-side chown, which is why the
  next change exists.
- GET /api/internal/backup/verify now reports process uid/gid,
  backup_dir_writable and the access errno, so the exact chown target is
  observable instead of guessed. A mounted-but-unwritable volume reads as
  'configured' everywhere else — this makes it loud.

Suite 278/3310 green, build exit 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SmNjJAwEnqHPtXbvSZR8kA

Dockerfile

@@ -60,8 +60,8 @@ COPY content ./content
 # Persistent volume for JSONL training data (resolutions survive
 # redeploys via the Coolify mount). PM2_HOME lives outside it so
 # supervisor state is local to the container.
-RUN mkdir -p /app/data/training /app/.pm2 \
-  && chown -R vyndr:vyndr /app/data /app/.pm2 \
+RUN mkdir -p /app/data/training /app/.pm2 /app/backups \
+  && chown -R vyndr:vyndr /app/data /app/.pm2 /app/backups \
   && chmod +x /app/scripts/docker-entrypoint.sh
 
 USER vyndr