matrix: registration token mode 0644 so tuwunel (dynamic user) can read it (#644)

hive-c0re/src/matrix.rs

@@ -123,7 +123,13 @@ pub fn ensure_register_token() -> Result<String> {
     }
     std::fs::write(path, format!("{token}\n"))
         .with_context(|| format!("write registration token to {}", path.display()))?;
-    let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600));
+    // Mode 0644: tuwunel inside the hive-matrix container runs as its
+    // own dynamic user (not root), so the bind-mounted file needs to
+    // be world-readable for tuwunel to load it. 0600 root-owned would
+    // block tuwunel with `Permission denied (os error 13)` (#644). On
+    // a single-tenant host the trade-off is acceptable; multi-tenant
+    // would need group-readable with explicit gid matching.
+    let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o644));
     tracing::info!(path = %path.display(), "matrix: generated registration token");
     Ok(token)
 }