fix(seerr): add fsGroup podSecurityContext to resolve non-root PVC CrashLoop

Seerr v3.4.1 (ghcr.io/seerr-team/seerr) runs as the non-root user node:node
(UID/GID 1000), unlike the old root-running sctx/overseerr image. Its root-owned
Longhorn RWO config PVC at /app/config was not writable by UID 1000, so the pod
CrashLoopBackOff'd with:

  Error: EACCES: permission denied, mkdir '/app/config/logs/'

Add a podSecurityContext with fsGroup=1000 (plus runAsUser/runAsGroup/runAsNonRoot)
to the seerr ServiceDefinition — the same schema 1.3.0 mechanism semaphore uses.
Longhorn's CSIDriver fsGroupPolicy: ReadWriteOnceWithFSType applies fsGroup to this
RWO filesystem volume, group-owning the PVC to GID 1000 so the process can write.
Re-rendered apps/wave-2/seerr.yaml from the catalog source.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/wave-2/seerr.yaml

@@ -81,6 +81,11 @@ spec:
         volumeMounts:
         - name: config
           mountPath: /app/config
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        fsGroup: 1000
       volumes:
       - name: config
         persistentVolumeClaim: