Ensure maildir ownership and permissions on user creation

[localzet]

Motivation

• New user creation sometimes produced Dovecot Permission denied errors because newly created maildir directories and the password file were not owned or permissioned for the vmail user.
• The change ensures maildir is writable by Dovecot immediately after creation so mailbox initialization and quota/index writes succeed.

Description

• Added ensure_maildir_permissions(...) which runs chown -R vmail:vmail <user_home>, chmod 0700 <user_home>, and chmod 0600 <user_home>/password and returns explicit validation errors on failure.
• Call ensure_maildir_permissions from create_user_account immediately after writing the hashed password file to guarantee correct ownership/permissions before auth tests and mailbox initialization.
• Validation errors from ownership/permission steps are surfaced as AppError::Validation with the stdout/stderr from the failing command.

Testing

• Ran cargo fmt which completed successfully.
• Ran cargo check which finished without errors and the crate built in dev profile.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c4f1fb5057

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Clean up partial account state on permission failure

If ensure_maildir_permissions(...) fails (for example when chown/chmod lacks privileges), this ? returns immediately after the password file has already been written, leaving a partially created account on disk. On the next attempt, password_path.exists() triggers "password file already exists", so user creation can get stuck until manual cleanup. Please remove the created file/directory on this failure path, similar to the existing auth/mailbox rollback behavior.

Useful? React with 👍 / 👎.