fix(ci): self-heal mysql env-file read access in deploy preflight

docker compose reads env_file client-side as the deploy user (ubuntu), so
the root-managed /opt/webapps/webapp-mysql.env (mode 600) caused
"open ...: permission denied" at `docker compose up`. Extend the deploy
preflight to grant docker-group read (chgrp docker + chmod 640) when the
deploy user cannot read it — idempotent, self-heals a rebuilt web VPS.
The live VPS file was already fixed out-of-band; this prevents recurrence.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -183,6 +183,15 @@ jobs:
               echo "docker group: adding $USER"
               sudo usermod -aG docker "$USER"
             fi
+            # docker compose reads env_file client-side as this user, so the
+            # root-managed DB secret must be group-readable by the deploy user.
+            MYSQL_ENV=/opt/webapps/webapp-mysql.env
+            if [ -f "$MYSQL_ENV" ] && ! [ -r "$MYSQL_ENV" ]; then
+              echo "mysql env: granting docker-group read"
+              sudo chgrp docker "$MYSQL_ENV" && sudo chmod 640 "$MYSQL_ENV"
+            else
+              echo "mysql env: readable (or absent)"
+            fi
           '
           # Prove a NEW session can reach the docker daemon before streaming ~GBs.
           ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \