fix(auth): login 500 — DataProtection key ring unreadable on root-owned keys volume

Root cause: a 'keys' Docker volume created by an older root-running image is owned
by root, but the container now runs as the non-root 'app' user (uid 1654). The API
can't read/write its DataProtection key ring, so encrypting the OAuth correlation
cookie fails and /api/v1/auth/login returns 500. (Staging was unaffected only because
its volumes were recreated fresh during the pgvector swap.)

Fixes:
- compose: a one-shot 'init-keys' service (root busybox) chowns the keys volume to
  1654:1654 before the api starts (depends_on service_completed_successfully). Auto-heals
  any pre-existing root-owned volume — local, staging, and future deployments.
- Dockerfile: install libgssapi-krb5-2 — the slim aspnet:10.0 image dropped it and
  Npgsql logged 'Cannot load library libgssapi_krb5.so.2' on every connection.

Verified on a clean local stack: 0 key-ring errors, 0 krb5 errors, login now 302.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -53,6 +53,16 @@ services:
       postgres:
         condition: service_healthy
 
+  # One-shot: ensure the DataProtection 'keys' volume is owned by the API's non-root
+  # 'app' user (uid 1654). A volume created by an older root-running image is root-owned,
+  # which makes the app fail to read its key ring and 500s on login. Runs as root, chowns,
+  # exits; the api waits for it. Idempotent and cheap.
+  init-keys:
+    image: busybox
+    command: ["sh", "-c", "chown -R 1654:1654 /keys"]
+    volumes:
+      - keys:/keys
+
   api:
     build:
       context: .
@@ -79,6 +89,8 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
+      init-keys:
+        condition: service_completed_successfully
     # V-08: bind to loopback so the API is not directly reachable from the network
     # (only via the frontend/nginx proxy over the internal compose network). This
     # prevents external clients from bypassing the proxy to spoof X-Forwarded-* headers.