pass the member's gid instead of reusing their uid

host caught that provisionRootlessDocker had no gid field, so the new
install -d passed uid in the group position. Correct on this host only because
useradd allocates a per-user group; wrong on any account whose gid is not its
uid — one created by hand, one on a host whose login.defs uses a shared group,
or one ensureOsUser adopted rather than created.

Mode 700 means the group triad grants nothing, so nothing breaks today. That is
what makes it worth fixing now rather than later: it would surface only after
somebody widened the mode for an unrelated reason, and then not obviously.

The call site already held account.gid from ensureOsUser — the same value the
.local fix used correctly earlier the same night. Threaded through rather than
derived, and the field carries a comment saying why it is separate from uid,
since they are equal here and a reader would ask.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/users/provision-os.ts

@@ -90,6 +90,7 @@ export async function provisionOsAccount(params: {
   const docker = await provisionRootlessDocker({
     osUser: account.osUser,
     uid: account.uid,
+    gid: account.gid,
     home: osUserHome(params.email),
   });