fix(startup): only chown runtime paths for custom PUID/PGID

Recursively chowning the entire /app tree on startup is extremely slow
on network- or HDD-backed storage (e.g. TrueNAS Apps). The Next.js
standalone bundle and its node_modules contain tens of thousands of
tiny files, turning the advertised ~10s ownership step into 15+ minutes.

Only chown the paths the non-root user actually writes to at runtime:
the /appdata volume, the Next.js cache directory and the nginx runtime
directories. Application code, DB migrations and native modules are only
read/executed and stay owned by root.

The known /appdata subdirectories are created and their existing content
recursively re-owned before dropping privileges, so a persistent volume
with stale or root-owned entries stays writable after a PUID/PGID change.
These trees are small, unlike the /app tree.

Closes #2190

scripts/entrypoint.sh

@@ -7,14 +7,31 @@ export PGID=${PGID:-0}
 echo "Starting with UID='$PUID', GID='$PGID'"
 
 if [ "${PUID}" != "0" ] || [ "${PGID}" != "0" ]; then
-    # The below command will change the owner of all files in the /app directory (except node_modules) to the new UID and GID
-    echo "Changing owner to $PUID:$PGID, this will take about 10 seconds..."
-    find . -name 'node_modules' -prune -o -mindepth 1 -maxdepth 1 -exec chown -R $PUID:$PGID {} +
-    chown -R $PUID:$PGID /var/cache/nginx
-    chown -R $PUID:$PGID /var/log/nginx
-    chown -R $PUID:$PGID /var/lib/nginx
-    chown -R $PUID:$PGID /run/nginx/nginx.pid
-    chown -R $PUID:$PGID /etc/nginx
+    # Only chown the paths the non-root user must actually write to at runtime.
+    # Recursively chowning the whole /app tree is extremely slow on network- or
+    # HDD-backed storage (e.g. TrueNAS Apps), because the Next.js standalone
+    # bundle and its node_modules contain tens of thousands of tiny files. This
+    # turned a ~10s step into 15+ minutes for some users (#2190). Application
+    # code, migrations and native modules are only read/executed, so they stay
+    # owned by root and do not need chowning.
+    echo "Changing owner to $PUID:$PGID..."
+    # Application data volume (db, redis dumps, trusted certificates).
+    # Ensure the known subdirectories exist and migrate ownership of any
+    # existing content, so a persistent volume with stale or root-owned
+    # entries stays writable after a PUID/PGID change. These trees are small
+    # (a single sqlite db, a redis dump, a few certs), unlike the /app tree.
+    mkdir -p /appdata/db /appdata/redis /appdata/trusted-certificates
+    chown "${PUID}:${PGID}" /appdata
+    chown -R "${PUID}:${PGID}" /appdata/db /appdata/redis /appdata/trusted-certificates
+    # Next.js runtime cache (image optimization, fetch cache, ...)
+    mkdir -p /app/apps/nextjs/.next/cache
+    chown -R "${PUID}:${PGID}" /app/apps/nextjs/.next/cache
+    # nginx runtime directories and the rendered configuration
+    chown -R "${PUID}:${PGID}" /var/cache/nginx
+    chown -R "${PUID}:${PGID}" /var/log/nginx
+    chown -R "${PUID}:${PGID}" /var/lib/nginx
+    chown -R "${PUID}:${PGID}" /run/nginx/nginx.pid
+    chown -R "${PUID}:${PGID}" /etc/nginx
     echo "Changing owner to $PUID:$PGID, done."
 fi