fix: detect Docker socket GID for container permissions

The Docker socket group varies by host (e.g., GID 1001 on WSL2).
Hardcoding group_add: ["0"] doesn't work when the socket is owned
by a different group. The installer now detects the socket GID at
install time via stat. The main docker-compose.yml uses a
configurable DOCKER_GID env var (defaults to 0).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.env.example

@@ -36,6 +36,9 @@ VENDOR_SEED_ENABLED=false
 # VENDOR_USER=vendor
 # VENDOR_PASS=change_me
 
+# Docker socket GID (run: stat -c '%g' /var/run/docker.sock)
+# DOCKER_GID=0
+
 # Docker images (override for custom registries)
 # TRAEFIK_IMAGE=gitea.siegeln.net/cameleer/cameleer-traefik
 # POSTGRES_IMAGE=gitea.siegeln.net/cameleer/cameleer-postgres