setup.sh: exec a fresh login shell at the end so docker group takes effect

Group membership added by 'usermod -aG docker' (in require_docker) doesn't
apply to the shell that invoked sudo — only to new logins. Users had to
manually run 'newgrp docker' or reconnect SSH after every install. Since a
child process can't change its parent shell's group list directly, the
practical fix is to exec a fresh 'su - ' login shell at the end
of the guided flow, which re-reads /etc/group and lands the user back in
the same terminal with docker access already active.

Gated on: running via sudo (SUDO_USER set), interactive (not --unattended),
docker group exists and the user is actually a member, and stdin is a real
tty — so this never fires for scripted/explicit-service/piped invocations.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LQJBvqzXeyuhhAcAA3Q5Wq

setup.sh

@@ -363,3 +363,16 @@ done
 
 echo ""
 log_success "Done. Re-run 'sudo ./setup.sh' any time to add more."
+
+# If Docker was installed this session (or already was), the invoking user
+# was added to the docker group — but group membership only takes effect in
+# a new login shell, not the one that ran sudo. Drop into a fresh login
+# shell as that user so 'docker' works immediately without reconnecting SSH.
+if [ -n "${SUDO_USER:-}" ] && [ "$UNATTENDED" != true ] \
+    && getent group docker >/dev/null 2>&1 \
+    && id -nG "$SUDO_USER" 2>/dev/null | grep -qw docker \
+    && [ -t 0 ]; then
+    echo ""
+    log_info "Refreshing shell as $SUDO_USER so the docker group takes effect..."
+    exec su - "$SUDO_USER"
+fi