fix: set SSH key ownership to container user with mode 600

- Mount SSH keys as bind (not ro) so docker exec --user root can chown
- Add apply_ssh_permissions() to permission_fixer.py
- Call apply_ssh_permissions() after container start for all instance types
- Derive container user from home_dir (/root → root, /home/user → user)
- Tests: apply_ssh_permissions unit tests + start_instance integration tests

Quality gates: pytest 236 passed (6 pre-existing failures), tsc --noEmit clean

apps/api/tests/unit/test_permission_fixer.py

@@ -7,6 +7,7 @@ import pytest
 from src.services.permission_fixer import (
     PermissionFixError,
     apply_mount_permissions,
+    apply_ssh_permissions,
     check_root_user_available,
     _run_in_container,
 )
@@ -132,6 +133,42 @@ class TestRunInContainer:
             _run_in_container("abc123", ["chown", "x"], 10)
 
 
+class TestApplySshPermissions:
+    """Tests for apply_ssh_permissions."""
+
+    @patch("src.services.permission_fixer._run_in_container")
+    def test_applies_chown_chmod_and_file_mode(self, mock_run) -> None:
+        result = apply_ssh_permissions("abc123", "/home/user/.ssh", "user")
+
+        assert result["success"] is True
+        assert mock_run.call_count == 3
+        chown_call = mock_run.call_args_list[0]
+        chmod_call = mock_run.call_args_list[1]
+        file_mode_call = mock_run.call_args_list[2]
+
+        assert chown_call[0][1] == ["chown", "-R", "user:user", "/home/user/.ssh"]
+        assert chmod_call[0][1] == ["chmod", "700", "/home/user/.ssh"]
+        assert file_mode_call[0][1][0] == "sh"
+        assert "find /home/user/.ssh -name 'id_*' -type f -exec chmod 600" in file_mode_call[0][1][2]
+
+    @patch("src.services.permission_fixer._run_in_container")
+    def test_uses_root_user(self, mock_run) -> None:
+        result = apply_ssh_permissions("abc123", "/root/.ssh", "root")
+
+        assert result["success"] is True
+        chown_call = mock_run.call_args_list[0]
+        assert chown_call[0][1] == ["chown", "-R", "root:root", "/root/.ssh"]
+
+    @patch("src.services.permission_fixer._run_in_container")
+    def test_reports_failure(self, mock_run) -> None:
+        mock_run.side_effect = PermissionFixError("chown failed")
+
+        result = apply_ssh_permissions("abc123", "/home/user/.ssh", "user")
+
+        assert result["success"] is False
+        assert "chown failed" in result["error"]
+
+
 class TestCheckRootUserAvailable:
     """Tests for check_root_user_available."""