Give the secrets directory its mode when init hands it to root, so the service can still read the store's address

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/cli/serverinit_postgres.go

@@ -389,6 +389,15 @@ func (in *serverInit) writeDSN(dsn string) error {
 	if err := in.chown(dir, false); err != nil {
 		return err
 	}
+	// Root's, and the service's group may enter it. Its mode set too, not
+	// only on creation: a directory made 0700 for the service user (as
+	// `server add` made them) and handed to root here was one the service
+	// could no longer open, and the gateway did not start.
+	if in.user != "" {
+		if err := os.Chmod(dir, 0o750); err != nil {
+			return err
+		}
+	}
 	if err := os.WriteFile(in.dsnPath(), []byte(dsn+"\n"), 0o600); err != nil {
 		return err
 	}