isolate user data with personal group ownership

- chown user dirs to pastilhas:<username> instead of pastilhas:officerdev
  so users cannot access each other's data
- chmod 2770 (setgid) gives only the owning user terminal access
- setup.sh: ensure home dir is traversable (o+x) for provisioned users

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/servers/api/users/provision.ts

@@ -84,10 +84,10 @@ export async function provisionLinuxUser(email: string, username: string): Promi
   await Bun.write(join(claudeDir, 'settings.json'), settingsContent);
 
   // Service user (pastilhas) owns everything — server can always read/write.
-  // Linux user gets group access via officerdev for terminal sessions only.
+  // User's personal group gives only that user terminal access. Others get nothing.
   const serviceUser = process.env.USER ?? 'pastilhas';
-  run(['sudo', 'chown', '-R', `${serviceUser}:${SHARED_GROUP}`, userRoot]);
-  run(['sudo', 'chmod', '-R', '2775', userRoot]);
+  run(['sudo', 'chown', '-R', `${serviceUser}:${shellUsername}`, userRoot]);
+  run(['sudo', 'chmod', '-R', '2770', userRoot]);
 
   console.log(`[provision] provisioning complete for ${shellUsername}`);
   return true;