fix(newsite): broaden post-validate chown to cover global Coraza logs

The previous fix only pre-created per-site logs, but `caddy validate` (run as
root) also touches globals like /var/log/caddy/coraza-audit.log when it
provisions the WAF module. If that file doesn't yet exist (no prior request
served), validate creates it as root:root and the subsequent reload-as-caddy
fails with "permission denied". Replace the per-site enumeration with a
recursive chown of CADDY_LOG_DIR after validate — matches the pattern
10-caddy.sh already uses post-install and covers any future log file Coraza
or other modules may introduce.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: qfiber

newsite.sh

@@ -464,17 +464,13 @@ success "Caddy config → ${CADDY_FILE}"
 # =============================================================================
 # Reload Caddy (validate first)
 # =============================================================================
-# Pre-create per-site log files owned by caddy. `caddy validate` runs as root
-# and would otherwise create them as root:root 0600, which the caddy daemon
-# (User=caddy) cannot open on the subsequent reload.
-declare -a SITE_LOGS=("${CADDY_LOG_DIR}/${DOMAIN}.log")
-[[ -n "${CADDY_API_FILE}" ]] && SITE_LOGS+=("${CADDY_LOG_DIR}/api.${DOMAIN}.log")
-for logf in "${SITE_LOGS[@]}"; do
-    [[ -f "${logf}" ]] || install -m 0640 -o caddy -g caddy /dev/null "${logf}"
-    chown caddy:caddy "${logf}"
-done
-
 if /usr/local/bin/caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile >/dev/null 2>&1; then
+    # `caddy validate` runs as root and provisions every module, which can
+    # create (or re-open) per-site logs AND globals like coraza-audit.log as
+    # root:root 0600. The caddy daemon (User=caddy) then cannot open them on
+    # reload, returning "permission denied". Re-chown the whole log dir before
+    # reload — same pattern 10-caddy.sh uses post-install.
+    chown -R caddy:caddy "${CADDY_LOG_DIR}"
     systemctl reload caddy && success "Caddy reloaded." || warn "Caddy reload failed."
 else
     warn "Caddy validation failed — review the snippet."