fix: deep-merge manifest with base to resolve container user UID/GID

- start_instance now deep-merges manifest with base definition before extracting user.uid/user.gid
- The user config is typically defined in the base image (ubuntu-24.04-dev), not the extending manifest
- Add debug logging to verify resolved uid/gid/home_dir
- Add logging to prepare_ssh_key_files for chown success/failure visibility
- Log current process uid when chown fails to diagnose permission issues

Quality gates: pytest 239 passed (6 pre-existing failures), tsc --noEmit clean

apps/api/tests/unit/test_ssh_keys.py

@@ -13,7 +13,9 @@ class TestPrepareSshKeyFiles:
     """Tests for prepare_ssh_key_files."""
 
     @patch("src.services.ssh_keys._get_fernet")
-    def test_creates_files_with_default_permissions(self, mock_fernet, tmp_path) -> None:
+    def test_creates_files_with_default_permissions(
+        self, mock_fernet, tmp_path
+    ) -> None:
         mock_fernet.return_value.decrypt.return_value = b"private-key-content"
         ssh_key = MagicMock()
         ssh_key.private_key_encrypted = "enc"
@@ -35,9 +37,7 @@ class TestPrepareSshKeyFiles:
         ssh_key.public_key = "ssh-ed25519 AAA test@test"
 
         with patch("os.chown") as mock_chown:
-            ssh_dir = prepare_ssh_key_files(
-                str(tmp_path), ssh_key, uid=1001, gid=1001
-            )
+            ssh_dir = prepare_ssh_key_files(str(tmp_path), ssh_key, uid=1001, gid=1001)
 
         # os.chown is called for the directory and each of the 3 files
         assert mock_chown.call_count == 4
@@ -56,8 +56,6 @@ class TestPrepareSshKeyFiles:
 
         with patch("os.chown", side_effect=PermissionError("not allowed")):
             # Should not raise
-            ssh_dir = prepare_ssh_key_files(
-                str(tmp_path), ssh_key, uid=1001, gid=1001
-            )
+            ssh_dir = prepare_ssh_key_files(str(tmp_path), ssh_key, uid=1001, gid=1001)
 
         assert Path(ssh_dir).exists()