feat(photos): firearm photo management with reusable upload/storage (#9)

.env.example

@@ -22,6 +22,12 @@ BETTER_AUTH_URL=http://localhost:3000
 ADMIN_EMAIL=admin@example.com
 ADMIN_PASSWORD=change-me-strong-admin-password
 
+# --- Storage ------------------------------------------------------------------
+# Directory the app reads/writes blobs (photo originals + derivatives) under.
+# In docker-compose this is a mounted named volume (magstacker-uploads); for
+# local tooling outside Docker, point it at any writable local directory.
+UPLOAD_DIR=/data/uploads
+
 # --- App --------------------------------------------------------------------
 APP_HOST_PORT=3000
 

Dockerfile

@@ -38,6 +38,14 @@ COPY --from=builder /app/auth.ts ./auth.ts
 COPY --from=builder /app/src ./src
 COPY --from=builder /app/scripts ./scripts
 
+# Create the upload root owned by the unprivileged runtime user BEFORE dropping
+# privileges. docker-compose mounts a NAMED volume at /data/uploads (UPLOAD_DIR);
+# Docker seeds an empty named volume from the image directory's contents AND
+# ownership on first use, so creating it bun-owned here makes the mounted volume
+# writable by uid `bun`. Without this the fresh volume mounts root-owned and the
+# first upload fails EACCES.
+RUN mkdir -p /data/uploads && chown bun:bun /data/uploads
+
 # Run as the unprivileged user shipped in the bun image.
 USER bun