revert: use chmod 770 instead of 775 for user directories

770 (rwxrwx---) is more secure - only owner and group can access, excluding 'others'.

The service user can still access because it's added to the user's group via:
  usermod -aG shellUsername serviceUser

The real fix was wrapping chmodSync in try/catch in email-db.ts so it doesn't
crash when trying to chmod files owned by other users.

scripts/provision-existing-users.sh

@@ -161,9 +161,9 @@ while IFS='|' read -r email username; do
   sudo mkdir -p "$HOME_DIR/.pi/agent/sessions"
 
   # Set ownership and permissions last
-  # chmod 775 so the service user (in the user's group) can read/write for background jobs
+  # chmod 770 so only owner and group can access (service user is added to group above)
   sudo chown -R "$shell_user:$shell_user" "$USER_ROOT"
-  sudo chmod -R 775 "$USER_ROOT"
+  sudo chmod -R 770 "$USER_ROOT"
 
   # Add service user to this user's group so server jobs can access user data
   SERVICE_USER="${SUDO_USER:-$(whoami)}"