fix: update provision-existing-users.sh to use chmod 775 (was 770)

Consistency fix with src/servers/api/users/provision.ts which was updated to use:
- chmod 775 (rwxrwxr-x) instead of 770 (rwxrwx---)
- Recursive chmod to fix all subdirectories

This allows the service user (in the user's group) to read/write files
for background jobs like email sync.

Also added helpful comment explaining the permission choice.

scripts/provision-existing-users.sh

@@ -161,8 +161,9 @@ while IFS='|' read -r email username; do
   sudo mkdir -p "$HOME_DIR/.pi/agent/sessions"
 
   # Set ownership and permissions last
+  # chmod 775 so the service user (in the user's group) can read/write for background jobs
   sudo chown -R "$shell_user:$shell_user" "$USER_ROOT"
-  sudo chmod 770 "$USER_ROOT"
+  sudo chmod -R 775 "$USER_ROOT"
 
   # Add service user to this user's group so server jobs can access user data
   SERVICE_USER="${SUDO_USER:-$(whoami)}"