setup-droplet.sh hands the validated access log to Caddy and restarts it; the kit's first droplet found the log owned by root

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jm2auWk6RP71CjaAb4FMoG

template/deploy/setup-droplet.sh

@@ -28,7 +28,9 @@ chmod -R g+rX /opt/__SLUG__
 # Caddy: the site and the game server's paths, from the template beside this script.
 sed "s|__HOST__|$HOST|" "$(dirname "$0")/Caddyfile.tmpl" > /etc/caddy/Caddyfile
 caddy validate --config /etc/caddy/Caddyfile
-systemctl reload caddy
+# Validation as root touches the access log; Caddy runs as caddy and must own it.
+chown -R caddy:caddy /var/lib/caddy
+systemctl restart caddy
 
 # Firewall: ssh + web only.
 ufw allow OpenSSH