fix: ensure container user owns ~/.config and other home dirs

Root cause: manifest-based Dockerfile created the home directory and
chowned only the home root. Files/directories copied from /etc/skel by
useradd -m (or created later by root) remained root-owned, so apps like
ranger failed when writing to ~/.config.

Changes:
- manifest_compiler.py: recursive chown of the home directory after
  useradd so /etc/skel contents are owned by the container user
- Pre-create .config, .local/share, .cache and chown them to the user
  so first-run apps have writable directories immediately
- Add unit test verifying the Dockerfile emits the expected user/home
  setup and config directory creation

Quality gates: py_compile all backend files pass, test file compiles,
tsc --noEmit pass, npm run build pass, 82/82 web tests pass
Note: pytest not available in this shell; backend unit test was not
executed but follows existing project conventions.

apps/api/src/services/build/manifest_compiler.py

@@ -172,10 +172,19 @@ def compile_dockerfile(manifest: dict) -> str:
         lines.append(f"ENV HOME={home}")
         lines.append(f"ENV USER={name}")
         lines.append("")
-        # Ensure home directory exists and is writable by the user
+        # Ensure home directory exists and is writable by the user.
+        # Recursively chown so any files copied from /etc/skel by useradd -m
+        # (e.g. .bashrc, .config) are owned by the container user.
         lines.append(
-            f"RUN mkdir -p {home} && chown {name}:{name} {home} && chmod 755 {home}"
+            f"RUN mkdir -p {home} && chown -R {name}:{name} {home} && chmod 755 {home}"
         )
+        # Pre-create common config directories so apps like ranger can write
+        # their configs on first run without permission errors.
+        common_dirs = [".config", ".local/share", ".cache"]
+        for d in common_dirs:
+            lines.append(
+                f"RUN mkdir -p {home}/{d} && chown -R {name}:{name} {home}/{d}"
+            )
         lines.append("")
 
         # Configure passwordless sudo so startup scripts can fix permissions