fix(systemd): ensure 0644 file permissions and document root execution for docker volumes

systemd/orario-update.service

@@ -5,10 +5,13 @@ Wants=network-online.target
 
 [Service]
 Type=oneshot
-# Adjust user/paths if needed for your server environment:
-User=caddy
-Group=caddy
-WorkingDirectory=/var/www/orario
-ExecStart=/usr/bin/node /var/www/orario/scripts/update-semester-data.js --output /var/www/orario/semester-data.json --quiet
+# NOTE: If your webroot (e.g. orario.volume) is created by Docker (owned by root:root),
+# run this service as root by leaving User/Group unset (or User=root).
+# The script automatically writes files with world-readable 0644 permissions so Caddy can read them.
+# If you prefer running as caddy, ensure 'chown -R caddy:caddy <webroot>' is run after docker builds.
+# User=caddy
+# Group=caddy
+WorkingDirectory=/srv/services/orario
+ExecStart=/usr/bin/node /srv/services/orario/src/scripts/update-semester-data.js --output /srv/services/orario/orario.volume/semester-data.json --quiet
 StandardOutput=journal
 StandardError=journal