fix(k8s): set fsGroup on pods with volumes

A freshly provisioned PVC mounts root:root, so any image that drops privileges
cannot write to it. docs-mcp-server runs as uid 1000 and died on first start
with SQLITE_CANTOPEN; its own Dockerfile says to chown the volume 1000:1000.

Pods with volumes now carry securityContext.fsGroup, defaulting to 1000 and
overridable per volume. fsGroupChangePolicy is OnRootMismatch so Kubernetes
does not walk and re-chown the whole volume on every start.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017BMXdb2qZbPSh8Q7XpTyjB

src/cli/src/commands/apply.ts

@@ -25,6 +25,7 @@ const VolumeSpecSchema = z.object({
   mountPath: z.string().min(1).regex(/^\//, 'mountPath must be absolute'),
   sizeGb: z.number().int().min(1).max(1024).default(10),
   storageClass: z.string().optional(),
+  fsGroup: z.number().int().min(0).max(65535).optional(),
 });
 
 const ServerSpecSchema = z.object({