fix(openapi): harden story 2.1 production lifecycle

apps/admin-api/docker-entrypoint.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+set -eu
+
+# Docker creates a fresh named volume as root:root 0755. The artifact store
+# deliberately rejects that mode: before starting the API, provision exactly
+# the private root its pinned-directory checks require.
+if [ "$#" -gt 0 ] && [ "$1" = "admin-api" ]; then
+    storage_root="${CRANK_STORAGE_ROOT:-/var/lib/crank/storage}"
+    case "$storage_root" in
+        /*) ;;
+        *)
+            echo "CRANK_STORAGE_ROOT must be an absolute path" >&2
+            exit 64
+            ;;
+    esac
+    if [ -L "$storage_root" ] || { [ -e "$storage_root" ] && [ ! -d "$storage_root" ]; }; then
+        echo "CRANK_STORAGE_ROOT must be a directory, not a symlink or file" >&2
+        exit 64
+    fi
+    umask 077
+    mkdir -p -- "$storage_root"
+    chmod 0700 -- "$storage_root"
+fi
+
+exec "$@"