fix(seerr): add fsGroup podSecurityContext to resolve non-root PVC CrashLoop

Seerr v3.4.1 (ghcr.io/seerr-team/seerr) runs as the non-root user node:node
(UID/GID 1000), unlike the old root-running sctx/overseerr image. Its root-owned
Longhorn RWO config PVC at /app/config was not writable by UID 1000, so the pod
CrashLoopBackOff'd with:

  Error: EACCES: permission denied, mkdir '/app/config/logs/'

Add a podSecurityContext with fsGroup=1000 (plus runAsUser/runAsGroup/runAsNonRoot)
to the seerr ServiceDefinition — the same schema 1.3.0 mechanism semaphore uses.
Longhorn's CSIDriver fsGroupPolicy: ReadWriteOnceWithFSType applies fsGroup to this
RWO filesystem volume, group-owning the PVC to GID 1000 so the process can write.
Re-rendered apps/wave-2/seerr.yaml from the catalog source.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/wave-2/seerr.yaml

@@ -81,6 +81,11 @@ spec:
         volumeMounts:
         - name: config
           mountPath: /app/config
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        fsGroup: 1000
       volumes:
       - name: config
         persistentVolumeClaim:

catalog/seerr.yaml

@@ -25,6 +25,20 @@ name: seerr
 kind: container
 source:
   image: ghcr.io/seerr-team/seerr:v3.4.1   # Seerr: maintained Overseerr/Jellyseerr successor, Plex-native request UI (docs/13 row 5); served on 5055
+# The ghcr.io/seerr-team/seerr image runs as the non-root user `node:node` (UID 1000 / GID 1000 —
+# the standard node base-image user; confirmed from the image config's User field). On boot the app
+# creates /app/config/logs and writes its settings/DB under the mounted /app/config PVC. A fresh
+# Longhorn PVC is root:root, so UID 1000 cannot mkdir there -> the pod CrashLoopBackOffs with
+# "EACCES: permission denied, mkdir '/app/config/logs/'". (The old sctx/overseerr image ran as root
+# and never hit this.) fsGroup=1000 makes the kubelet group-own the mounted PVC to GID 1000 and add
+# it as a supplemental group so the process can write — Longhorn's CSIDriver
+# fsGroupPolicy: ReadWriteOnceWithFSType applies fsGroup to this RWO filesystem volume. runAsUser/
+# runAsGroup pin the image's own identity, runAsNonRoot asserts it (same pattern as semaphore; R-STATE-01/02).
+podSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+  runAsNonRoot: true
+  fsGroup: 1000
 exposure: public                 # edge port-forward + public DNS (docs/09; R-DNS/R-NET)
 egress: internet                 # normal WAN egress (docs/03; R-NET-05) — TMDB/Plex.tv metadata over the internet
 storage: