log-guard: root supervisord program keeps dated log files cloudron-owned

A host-side daily job creates the next day's dated log files as root:root at
00:00 UTC; LibreChat (cloudron user) then EACCES-crashes on its first log
write of the day (2026-10-22 and 2026-10-23 incidents). The guard pre-creates
today's and tomorrow's files as cloudron and repairs strays every minute.
Defense-in-depth until the host rotation config is fixed.

Dockerfile

@@ -65,3 +65,11 @@ RUN python3 /app/code/patch_index.py && \
 # light + dark pair so browser/PWA chrome matches the phone theme natively.
 RUN sed -i 's|"theme_color": *"#009688"|"theme_color":"#eaf3ea"|; s|"background_color": *"#000000"|"background_color":"#eaf3ea"|' /app/code/librechat/client/dist/manifest.webmanifest && \
     sed -i 's|<meta name="theme-color" content="#171717" />|<meta name="theme-color" media="(prefers-color-scheme: light)" content="#eaf3ea" />\n    <meta name="theme-color" media="(prefers-color-scheme: dark)" content="#22271f" />|' /app/code/librechat/client/dist/index.html
+
+# Log ownership guard: a host-side daily job creates the next day's dated log
+# files in /app/data/logs as root:root at 00:00 UTC; LibreChat (cloudron user)
+# then crashes with EACCES on its first log write of the day. This supervisor
+# program runs as root and keeps the dated files cloudron-owned (see
+# assets/log-guard.sh). Remove once the host logrotate config is fixed.
+COPY assets/log-guard.sh /app/code/log-guard.sh
+RUN printf '[program:logguard]\ncommand=/bin/bash /app/code/log-guard.sh\nuser=root\nautorestart=true\nstartsecs=0\npriority=1\n' > /etc/supervisor/conf.d/logguard.conf