fix(agent): unify agent and openresty runtime user as openflare

Introduce the shared openflare service account for the agent process and
OpenResty workers, normalize data_dir ownership on startup, and ensure
managed paths are chowned with 0755/0644 during sync and apply. Docker
entrypoint fixes volume ownership before dropping privileges; local systemd
install runs the service as openflare with CAP_NET_BIND_SERVICE.

docker/agent-entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+
+RUNTIME_USER="openflare"
+AGENT_BIN="/usr/local/bin/openflare-agent"
+OPENRESTY_BIN="/usr/local/openresty/nginx/sbin/nginx"
+
+fix_runtime_ownership() {
+  for target in /data /etc/openflare; do
+    if [ -d "$target" ]; then
+      chown -R "${RUNTIME_USER}:${RUNTIME_USER}" "$target" 2>/dev/null || true
+      chmod -R u+rwX,g+rX "$target" 2>/dev/null || true
+    fi
+  done
+}
+
+if [ "$(id -u)" -eq 0 ]; then
+  fix_runtime_ownership
+  exec su-exec "${RUNTIME_USER}" "${AGENT_BIN}" "$@"
+fi
+
+exec "${AGENT_BIN}" "$@"