fix: add detailed SSH permission fix logging for debugging

- Replace apply_ssh_permissions internals with _exec_and_log for full visibility
- Log every docker exec command, stdout, and stderr at DEBUG level
- After chown/chmod, run ls -la and stat to verify final state
- Log verified state at INFO level so users can see exactly what happened
- Update tests to mock subprocess.run instead of _run_in_container

Quality gates: pytest 236 passed (6 pre-existing), tsc --noEmit clean

apps/api/tests/unit/test_permission_fixer.py

@@ -136,32 +136,35 @@ class TestRunInContainer:
 class TestApplySshPermissions:
     """Tests for apply_ssh_permissions."""
 
-    @patch("src.services.permission_fixer._run_in_container")
+    @patch("subprocess.run")
     def test_applies_chown_chmod_and_file_mode(self, mock_run) -> None:
+        mock_run.return_value = MagicMock(returncode=0, stdout="", stderr="")
         result = apply_ssh_permissions("abc123", "/home/user/.ssh", "user")
 
         assert result["success"] is True
-        assert mock_run.call_count == 3
-        chown_call = mock_run.call_args_list[0]
-        chmod_call = mock_run.call_args_list[1]
-        file_mode_call = mock_run.call_args_list[2]
+        # 3 fix commands + 3 verification commands
+        assert mock_run.call_count == 6
+        chown_cmd = mock_run.call_args_list[0][0][0]
+        chmod_cmd = mock_run.call_args_list[1][0][0]
+        file_mode_cmd = mock_run.call_args_list[2][0][0]
 
-        assert chown_call[0][1] == ["chown", "-R", "user:user", "/home/user/.ssh"]
-        assert chmod_call[0][1] == ["chmod", "700", "/home/user/.ssh"]
-        assert file_mode_call[0][1][0] == "sh"
-        assert "find /home/user/.ssh -name 'id_*' -type f -exec chmod 600" in file_mode_call[0][1][2]
+        assert chown_cmd == ["docker", "exec", "--user", "root", "abc123", "chown", "-R", "user:user", "/home/user/.ssh"]
+        assert chmod_cmd == ["docker", "exec", "--user", "root", "abc123", "chmod", "700", "/home/user/.ssh"]
+        assert file_mode_cmd[0] == "docker"
+        assert "find /home/user/.ssh -name 'id_*' -type f -exec chmod 600" in file_mode_cmd[-1]
 
-    @patch("src.services.permission_fixer._run_in_container")
+    @patch("subprocess.run")
     def test_uses_root_user(self, mock_run) -> None:
+        mock_run.return_value = MagicMock(returncode=0, stdout="", stderr="")
         result = apply_ssh_permissions("abc123", "/root/.ssh", "root")
 
         assert result["success"] is True
-        chown_call = mock_run.call_args_list[0]
-        assert chown_call[0][1] == ["chown", "-R", "root:root", "/root/.ssh"]
+        chown_cmd = mock_run.call_args_list[0][0][0]
+        assert chown_cmd == ["docker", "exec", "--user", "root", "abc123", "chown", "-R", "root:root", "/root/.ssh"]
 
-    @patch("src.services.permission_fixer._run_in_container")
+    @patch("subprocess.run")
     def test_reports_failure(self, mock_run) -> None:
-        mock_run.side_effect = PermissionFixError("chown failed")
+        mock_run.return_value = MagicMock(returncode=1, stdout="", stderr="chown failed")
 
         result = apply_ssh_permissions("abc123", "/home/user/.ssh", "user")