Grant smsrelay's ACL access after the Asterisk restart, not before

Reproduced live: pstn-personal-dids.conf was confirmed readable by
smsrelay right after a manual ACL grant, then unreadable again
("does not exist" in the relay's log -- os.path.isfile() swallows the
PermissionError and just returns False) immediately after the very next
fresh install. The only thing that ran in between was this same
install's own Asterisk container restart (needed to pick up the new AMI
secret).

The ACL grant was sequenced BEFORE that restart. CLAUDE.md documents the
container's entrypoint re-chowning its mounted config directory on every
restart and says chown alone can't touch ACL entries -- true, but
apparently this image's entrypoint also chmods, and chmod recomputes a
directory's ACL mask entry, which can silently weaken a named-user grant
made before it even though the grant's ACL entry itself is untouched.

Fix: do the grant last, after the restart-or-not branch, so nothing left
in this install run can undo it. ensure_docker_dir_ownership() (chown
only, confirmed in lib/common.sh, no chmod) stays where it was --
chow doesn't need this ordering fix, only the ACL grant does.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JDyKC6Kdg7tofmYSmRtgww

services/sms-inbound.sh

@@ -723,7 +723,6 @@ install_sms-inbound() {
     local MGR_STATE
     MGR_STATE="$(_sms_write_manager_conf "$ASTERISK_DIR" "$AMI_SECRET")"
     ensure_docker_dir_ownership "$ASTERISK_DIR"
-    _sms_grant_asterisk_read_access "$SMS_SVC_USER" "$ASTERISK_DIR"
 
     if [[ "$MGR_STATE" != "unchanged" ]]; then
         echo ""
@@ -743,6 +742,20 @@ install_sms-inbound() {
         fi
     fi
 
+    # Grant smsrelay's ACL access AFTER any Asterisk container restart above,
+    # not before. The container's entrypoint re-chowns (and, apparently on
+    # this image, re-chmods) its mounted config directory on every restart —
+    # chown alone leaves ACL entries alone (that's the whole reason this uses
+    # ACLs over chmod/group membership in the first place, see CLAUDE.md),
+    # but a chmod recomputes the ACL mask entry and can silently weaken a
+    # grant made before it. Confirmed live: pstn-personal-dids.conf was
+    # readable by smsrelay immediately after a manual grant+test, then
+    # unreadable again ("does not exist" — os.path.isfile() swallows the
+    # PermissionError) right after the very next fresh install, which
+    # restarts Asterisk for the new AMI secret. Granting last means nothing
+    # runs afterward in this same install to undo it.
+    _sms_grant_asterisk_read_access "$SMS_SVC_USER" "$ASTERISK_DIR"
+
     # ── Relay service ─────────────────────────────────────────────────────────
     mkdir -p "$SMS_APP_DIR"
     # Stop any instance of this exact service BEFORE scanning for a free