Ensure analysis directory creation uses correct ownership/permissions

Problem

The entrypoint script (docker/server/rails-entrypoint.sh) sets chmod 777 on parent directories (/mnt/openstudio/server/analyses, etc.) and sets umask 0000. However, there are concerns:

1. No explicit ownership is set anywhere — ownership is entirely determined by the process UID at runtime
2. Individual analysis subdirectories created at runtime by FileUtils.mkdir_p in run_simulate_data_point.rb:35-38 inherit permissions from umask, but are never explicitly chmod'd
3. Known CI issue: The specs document that when running as root in Docker CI, root-owned assets/analyses directories break later uploads by the unprivileged app user (analysis_init_spec.rb lines 22-27)
4. No chown calls exist anywhere in the codebase

Current Behavior

• Entrypoint creates parent dirs with chmod 777 + umask 0000
• Runtime dirs rely solely on umask inheritance
• No verification that the running user can actually read/write the created directories

Proposed Fix

• In rails-entrypoint.sh, ensure directories are owned by the correct user (e.g., chown -R app:app /mnt/openstudio if running as non-root)
• Consider adding an explicit chmod after mkdir_p calls in the job runner to guarantee consistent permissions
• Add a startup check that verifies the app user can write to the analyses directory
• Document the expected UID/GID for the container

Files to Modify

• docker/server/rails-entrypoint.sh
• server/app/jobs/dj_jobs/run_simulate_data_point.rb
• Potentially Dockerfile (ensure USER directive is correct)

Related

Specs documenting the known issue: server/spec/models/analysis_init_spec.rb, server/spec/models/analyses_upload_spec.rb

Start with docker/server/rails-entrypoint.sh and server/app/jobs/dj_jobs/run_simulate_data_point.rb:35-38, then read the documented cases in server/spec/models/analysis_init_spec.rb:22-27 and server/spec/models/analyses_upload_spec.rb. Done means the container-created analysis directories have predictable ownership and permissions, and the affected upload scenarios remain usable by the app user.