HEL-271: 反代证书挂载收紧为单文件并按属主 uid 运行（server.key 保持 0600）

Co-authored-by: multica-agent <github@multica.ai>

deploy/compose.yaml

@@ -59,12 +59,15 @@ services:
       - "${PROXY_PORT_MAP:-8443:8443}"
     volumes:
       - ./tls/nginx.conf:/etc/nginx/conf.d/default.conf:ro
-      - ./tls/certs:/etc/nginx/tls:ro
+      - ./tls/certs/server.crt:/etc/nginx/tls/server.crt:ro
+      - ./tls/certs/server.key:/etc/nginx/tls/server.key:ro
+    # 与证书文件属主一致的 uid/gid（默认 101=镜像 nginx 用户；宿主机生成证书时
+    # 设为属主 uid/gid，保持 server.key 0600 不放宽）
+    user: "${PROXY_UID:-101}:${PROXY_GID:-101}"
     depends_on:
       - app
     restart: unless-stopped
     read_only: true
-    user: "101:101"
     tmpfs:
       - /var/cache/nginx:size=16m
       - /var/run:size=1m