isolate user data with personal group ownership

- chown user dirs to pastilhas:<username> instead of pastilhas:officerdev
  so users cannot access each other's data
- chmod 2770 (setgid) gives only the owning user terminal access
- setup.sh: ensure home dir is traversable (o+x) for provisioned users

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/setup.sh

@@ -63,6 +63,14 @@ else
   ok "added $USER to officerdev group"
 fi
 
+# Ensure provisioned users can traverse to data directories
+if [ "$(stat -c '%A' "$HOME" | cut -c10)" = "x" ]; then
+  skip "home dir traversable"
+else
+  chmod o+x "$HOME"
+  ok "made home dir traversable (o+x)"
+fi
+
 # ─── 1. core system packages ───────────────────────────────────────────────────
 echo ""
 echo "── Core system packages ──"

src/servers/api/users/provision.ts

@@ -84,10 +84,10 @@ export async function provisionLinuxUser(email: string, username: string): Promi
   await Bun.write(join(claudeDir, 'settings.json'), settingsContent);
 
   // Service user (pastilhas) owns everything — server can always read/write.
-  // Linux user gets group access via officerdev for terminal sessions only.
+  // User's personal group gives only that user terminal access. Others get nothing.
   const serviceUser = process.env.USER ?? 'pastilhas';
-  run(['sudo', 'chown', '-R', `${serviceUser}:${SHARED_GROUP}`, userRoot]);
+  run(['sudo', 'chown', '-R', `${serviceUser}:${shellUsername}`, userRoot]);
-  run(['sudo', 'chmod', '-R', '2775', userRoot]);
+  run(['sudo', 'chmod', '-R', '2770', userRoot]);
 
   console.log(`[provision] provisioning complete for ${shellUsername}`);
   return true;