fix(paperless-ai): let the token sidecar read its own key

A Secret volume is owned by root and the sidecar runs as 65532, so defaultMode 0400
left it unable to open /var/run/llm-key/key: the container restarted with
'permission denied' on every start and never minted a token.

Set mode 0440 and give the pod fsGroup 65532, so the group that owns the volume can
read the key while nothing else on the host can.

k8s/apps/paperless/paperless-ai.yaml

@@ -39,7 +39,10 @@ spec:
         - name: llm-key
           secret:
             secretName: paperless-llm-key
-            defaultMode: 0400
+            # 0440 with the pod's fsGroup. A Secret volume is owned by root, and the
+            # vendor container runs as 65532, so 0400 left the sidecar unable to read
+            # its own key: "permission denied" on every start.
+            defaultMode: 0440
       # No init container. The token used to be fetched once at pod start with a
       # client_credentials grant against a web app, which cannot work: a web app has
       # no such grant, and even a token that was minted would be dead within the hour
@@ -49,6 +52,9 @@ spec:
       # exchanges it for a token, and rewrites /app/data/llm_token.txt at 80% of the
       # token lifetime. The vendor image keeps reading CUSTOM_API_KEY_FILE unchanged.
       # The key is re-read on every mint, so a rotation lands without a restart.
+      securityContext:
+        fsGroup: 65532
+        fsGroupChangePolicy: OnRootMismatch
       containers:
         - name: llm-token-vendor
           image: forgejo.riotpiao.com/riotpiao-poimen/llm-token-vendor:0.1.0