fix(e2e): read setup-token via exec; reclaim /data

Container startup is green; CI failed because panel-owned setup-token (0600)
was unreadable on the host bind mount, and TempDir cleanup hit EACCES on
sqlite/opendkim files. Read the token with compose exec (as guide.md) and
chown /data before removing containers/stage.

Co-Authored-By: Composer <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

test/e2e/panel_client.go

@@ -7,8 +7,6 @@ import (
 	"net/http"
 	"net/http/cookiejar"
 	"net/url"
-	"os"
-	"path/filepath"
 	"regexp"
 	"strings"
 	"time"
@@ -60,26 +58,38 @@ func waitForPanelReady() error {
 	})
 }
 
-// readSetupToken reads the one-time setup URL SelfPost wrote to /data (bind
-// mounted at stageDir/data/setup-token) and returns just the token.
-func readSetupToken(stageDir string) (string, error) {
-	var raw []byte
+// readSetupToken reads the one-time setup URL from /data/setup-token inside
+// the running selfpost container. The file is mode 0600 owned by the panel
+// UID (security.md / setup.go); on a typical CI bind mount that is not the
+// host runner's UID, so a host-side os.ReadFile returns permission denied
+// even though the panel already wrote the token (CI: setup_and_login).
+// Reading via compose exec matches docs/guide.md ("docker compose exec
+// selfpost cat /data/setup-token").
+func readSetupToken(s *stack) (string, error) {
+	var raw string
 	err := waitFor("setup-token to appear", 30*time.Second, 300*time.Millisecond, func() (bool, error) {
-		b, err := os.ReadFile(filepath.Join(stageDir, "data", "setup-token"))
+		out, err := s.execIn("selfpost", "cat", "/data/setup-token")
 		if err != nil {
 			return false, err
 		}
-		raw = b
-		return len(b) > 0, nil
+		raw = out
+		return strings.TrimSpace(out) != "", nil
 	})
 	if err != nil {
 		return "", err
 	}
-	u, err := url.Parse(strings.TrimSpace(string(raw)))
+	u, err := url.Parse(strings.TrimSpace(raw))
 	if err != nil {
 		return "", fmt.Errorf("parse setup token file: %w", err)
 	}
-	return strings.TrimPrefix(u.Path, "/setup/"), nil
+	token := strings.TrimPrefix(u.Path, "/setup/")
+	// #region agent log
+	agentDebugLog("H9", "panel_client.go:readSetupToken", "setup token via docker exec", map[string]any{
+		"tokenLen": len(token),
+		"rawLen":   len(strings.TrimSpace(raw)),
+	})
+	// #endregion
+	return token, nil
 }
 
 func (c *panelClient) postForm(path string, form url.Values) (*http.Response, string, error) {