fix(k8s): set fsGroup on pods with volumes

A freshly provisioned PVC mounts root:root, so any image that drops privileges
cannot write to it. docs-mcp-server runs as uid 1000 and died on first start
with SQLITE_CANTOPEN; its own Dockerfile says to chown the volume 1000:1000.

Pods with volumes now carry securityContext.fsGroup, defaulting to 1000 and
overridable per volume. fsGroupChangePolicy is OnRootMismatch so Kubernetes
does not walk and re-chown the whole volume on every start.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017BMXdb2qZbPSh8Q7XpTyjB

src/mcpd/src/services/instance.service.ts

@@ -381,6 +381,7 @@ export class InstanceService {
         mountPath: string;
         sizeGb?: number;
         storageClass?: string;
+        fsGroup?: number;
       }>;
       if (volumes.length > 0) {
         spec.volumes = volumes.map((v) => ({
@@ -390,6 +391,7 @@ export class InstanceService {
           ...(v.storageClass !== undefined && v.storageClass !== ''
             ? { storageClass: v.storageClass }
             : {}),
+          ...(v.fsGroup !== undefined ? { fsGroup: v.fsGroup } : {}),
         }));
       }
       // Package-based servers: command = [packageName, ...args] (entrypoint handles execution)