fix(ci): let the preview webapp start its nginx workers

.changeset/previews-serve-their-frontend.md

@@ -0,0 +1,5 @@
+---
+---
+
+Corrects the preview stack before pull request previews reach a release; no deployed behaviour
+changes.

docker/preview/compose.app.yaml

@@ -327,7 +327,6 @@ services:
           cpus: "1.0"
           memory: 2G
           pids: 512
-
   webapp:
     image: ghcr.io/ls1intum/hephaestus/webapp:${SOURCE_COMMIT:?Coolify supplies the deployed commit}
     # `expose` is how Coolify learns which port to route ${SERVICE_FQDN_WEBAPP} to; the image's own
@@ -351,6 +350,13 @@ services:
       - no-new-privileges:true
     cap_drop:
       - ALL
+    # nginx's master chowns its cache directories and then runs its workers as the nginx user. With
+    # CHOWN alone the master survives and every worker exits "fatal code 2 and cannot be respawned",
+    # which leaves a container that looks up and serves nothing.
+    cap_add:
+      - CHOWN
+      - SETGID
+      - SETUID
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1:80/"]
       interval: 10s

scripts/check-preview-stack.ts

@@ -116,11 +116,13 @@ const RENDER_ENV: Record<string, string> = {
 /** Values the server refuses to start without: it validates them before the context is built, so an
  * empty one here is a preview that restart-loops rather than a preview that misbehaves quietly. */
 /**
- * Capabilities a service may add back after `cap_drop: ALL`. PostgreSQL's entrypoint chowns its data
- * directory and drops to its own user, which needs these five; every other service runs with none.
+ * Capabilities a service may add back after `cap_drop: ALL`. Both entries are servers whose root
+ * process prepares a directory and then runs its real work as another user; each set is the minimum
+ * found by running the image with less. The application server needs none.
  */
 const ALLOWED_CAPABILITIES: Record<string, readonly string[]> = {
 	postgres: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"],
+	webapp: ["CHOWN", "SETGID", "SETUID"],
 };
 
 const REQUIRED_NON_EMPTY = ["HEPHAESTUS_TRUSTED_PROXIES", "WEBHOOK_SECRET"];