fix: add --chown=app:app to COPY in Dockerfile final stage

The chiseled image's 'app' user (UID 1654) cannot write to /app/wwwroot/
for sitemap.xml generation at startup. Setting ownership on COPY resolves
the UnauthorizedAccessException without requiring chmod or extra layers.

Author: BenjaminMichaelis

EssentialCSharp.Web/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.4
 
-FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled AS base
+FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled-extra AS base
 WORKDIR /app
 EXPOSE 8080
 EXPOSE 8081
@@ -19,20 +19,21 @@ WORKDIR /src
 COPY . .
 COPY --from=frontend-build /frontend/EssentialCSharp.Web/wwwroot/dist ./EssentialCSharp.Web/wwwroot/dist
 RUN --mount=type=secret,id=nuget_pat,required=false \
-    cp nuget.config nuget.config.bak && \
-    if [ "$ACCESS_TO_NUGET_FEED" = "true" ] && [ -f /run/secrets/nuget_pat ]; then \
-      dotnet nuget update source EssentialCSharp \
-        --username az \
-        --password "$(cat /run/secrets/nuget_pat)" \
-        --store-password-in-clear-text; \
+    if [ "$ACCESS_TO_NUGET_FEED" = "true" ] && [ ! -s /run/secrets/nuget_pat ]; then \
+      echo "ERROR: ACCESS_TO_NUGET_FEED=true but nuget_pat secret is missing or empty" >&2; exit 1; \
+    fi && \
+    if [ "$ACCESS_TO_NUGET_FEED" = "true" ]; then \
+      mkdir -p /root/.nuget/NuGet && \
+      printf '<?xml version="1.0" encoding="utf-8"?>\n<configuration>\n  <packageSourceCredentials>\n    <EssentialCSharp>\n      <add key="Username" value="az" />\n      <add key="ClearTextPassword" value="%s" />\n    </EssentialCSharp>\n  </packageSourceCredentials>\n</configuration>\n' \
+        "$(cat /run/secrets/nuget_pat)" > /root/.nuget/NuGet/NuGet.Config; \
     fi && \
     dotnet restore "EssentialCSharp.Web.slnx" -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED && \
     dotnet build "EssentialCSharp.Web.slnx" -c Release --no-restore -p:AccessToNugetFeed=$ACCESS_TO_NUGET_FEED -p:ReleaseDateAttribute=True -p:SkipFrontendBuild=true && \
     dotnet publish "EssentialCSharp.Web.slnx" -c Release -p:PublishDir=/app/publish -p:UseAppHost=false -p:SkipFrontendBuild=true --no-build && \
-    mv nuget.config.bak nuget.config
+    rm -f /root/.nuget/NuGet/NuGet.Config
 
 FROM base AS final
 WORKDIR /app
-COPY --from=build /app/publish .
+COPY --chown=app:app --from=build /app/publish .
 USER app
 ENTRYPOINT ["dotnet", "EssentialCSharp.Web.dll"]