fix(packaging): make /etc/mcpproxy writable by the service user (#825)

Companion to #822. That PR added /etc/mcpproxy to ReadWritePaths=, lifting
systemd's ProtectSystem=strict namespace restriction — necessary but not
sufficient, because POSIX permissions still apply.

nfpm declares only the FILES under /etc/mcpproxy, so the directory ships
implicitly as root:root 0755 (verified against a .deb built from this tree).
The service runs as User=mcpproxy, and SaveConfig -> atomicWriteFile creates
mcp_config.json.tmp.<hex> in that directory before renaming it, so the service
needs write+search on the directory itself. os.MkdirAll(dir, 0700) is a no-op
on an existing directory, so nothing repaired it at runtime.

postinstall.sh now runs:

    install -d -m 2770 -o root -g mcpproxy /etc/mcpproxy

2770: group-writable for mcpproxy, setgid so new files keep the group, no
access for others (the config holds API keys). Mirrors the existing install -d
for /var/lib/mcpproxy, and repairs permissions on hosts upgrading from an
earlier package.

Author: Dumbris

packaging/linux/postinstall.sh

@@ -6,6 +6,22 @@ set -e
 
 install -d -m 0750 -o mcpproxy -g mcpproxy /var/lib/mcpproxy
 
+# /etc/mcpproxy must be writable by the service, not just readable. Saving from
+# the web UI goes through config.SaveConfig -> atomicWriteFile, which creates
+# mcp_config.json.tmp.<hex> IN THIS DIRECTORY and renames it over the config —
+# so the mcpproxy user needs write+search on the directory itself, not merely
+# on the file. nfpm creates /etc/mcpproxy implicitly (root:root 0755) because
+# only the files inside it are declared, which left the service unable to
+# create the temp file. Adding /etc/mcpproxy to ReadWritePaths= in the unit
+# (PR #822) lifts systemd's ProtectSystem=strict namespace restriction; this
+# lifts the POSIX one. Both are required.
+#
+# 2770: group-writable so mcpproxy can write, setgid so files created here keep
+# the mcpproxy group, and no access for others (the config holds API keys).
+# Doing it here rather than as an nfpm dir entry also repairs the permissions
+# on hosts that installed an earlier package.
+install -d -m 2770 -o root -g mcpproxy /etc/mcpproxy
+
 if command -v systemctl >/dev/null 2>&1; then
     systemctl daemon-reload || true
     if [ -d /run/systemd/system ]; then