docker compose reads env_file client-side as the deploy user (ubuntu), so
the root-managed /opt/webapps/webapp-mysql.env (mode 600) caused
"open ...: permission denied" at `docker compose up`. Extend the deploy
preflight to grant docker-group read (chgrp docker + chmod 640) when the
deploy user cannot read it — idempotent, self-heals a rebuilt web VPS.
The live VPS file was already fixed out-of-band; this prevents recurrence.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
