Omar Sobh
977a1233af
Fixes 500 on any broker-touching route (POST /api/repos/connections, POST /api/apps, the OAuth callback) when broker + server run under different UIDs — which is exactly the prod topology on gw-04 (broker uid 10001, clawmates-server distroless nonroot uid 65532). Linux Unix socket connect(2) requires read+write on the socket file, and the default bind mode 0755 gives 'others' r-x only. Widen to 0666 after bind. The broker socket only lives inside the shared broker_run volume — two containers mount it, nothing else on the host can see it — so widening is safe. If set_permissions is a no-op on the target filesystem (abstract sockets on some kernels), we log and continue instead of failing serve().