Merge remote-tracking branch 'origin/develop' into develop

- Create var/log in Dockerfile (fixes Symfony logging in prod)
- Add www-data to docker group (fixes docker CLI access for health/deploy)
- Remove obsolete /var/www/maintenance/* dirs (volumes mount app dirs directly)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infra/prod/Dockerfile

@@ -71,10 +71,14 @@ COPY --from=frontend-build /app/frontend/.output/public /var/www/html/frontend/.
 # Symfony needs a .env file to boot (variables are overridden by env_file in docker-compose)
 RUN echo "APP_ENV=prod" > /var/www/html/.env
 
-# Permissions
-RUN mkdir -p /var/www/html/var /var/www/html/var/uploads \
-    /var/www/maintenance/sirh /var/www/maintenance/lesstime /var/www/maintenance/inventory \
-    && chown -R www-data:www-data /var/www/html/var /var/www/maintenance
+# Permissions + directories
+RUN mkdir -p /var/www/html/var/log /var/www/html/var/uploads \
+    && chown -R www-data:www-data /var/www/html/var
+
+# Allow www-data to use Docker socket
+# The socket GID varies per host; we set it at container startup via entrypoint
+# As fallback, install docker group with common GID
+RUN groupadd -g 999 docker 2>/dev/null; usermod -aG docker www-data
 
 WORKDIR /var/www/html
 EXPOSE 80