Add sqlite write permission check and preStart chown

- newSqliteStore now checks directory writability before opening
- Immediate SELECT 1 ping catches readonly DB early
- Systemd preStart chown ensures db file ownership is correct
- Fixes: SQLITE_READONLY_CANTINIT (1032)

sqlite.go

@@ -6,6 +6,7 @@ import (
 	"embed"
 	"encoding/json"
 	"fmt"
+	"os"
 	"strings"
 
 	"github.com/pressly/goose/v3"
@@ -20,6 +21,16 @@ type sqliteStore struct {
 }
 
 func newSqliteStore(path string) (*sqliteStore, error) {
+	dir := path
+	if idx := strings.LastIndexByte(path, '/'); idx > 0 {
+		dir = path[:idx]
+		if fi, err := os.Stat(dir); err != nil {
+			return nil, fmt.Errorf("sqlite dir %s: %w", dir, err)
+		} else if fi.Mode().Perm()&0200 == 0 {
+			return nil, fmt.Errorf("sqlite dir %s is not writable (mode %o)", dir, fi.Mode().Perm())
+		}
+	}
+
 	db, err := sql.Open("sqlite", path)
 	if err != nil {
 		return nil, fmt.Errorf("open sqlite: %w", err)
@@ -27,6 +38,11 @@ func newSqliteStore(path string) (*sqliteStore, error) {
 
 	db.SetMaxOpenConns(1)
 
+	if _, err := db.Exec("SELECT 1"); err != nil {
+		db.Close()
+		return nil, fmt.Errorf("sqlite ping: %w", err)
+	}
+
 	goose.SetBaseFS(embedMigrations)
 
 	if err := goose.SetDialect("sqlite3"); err != nil {