Move config files to /etc/micronas/, fix WebDAV passwd permissions

- /etc/micronas.env      → /etc/micronas/micronas.env
- /etc/micronas-webdav.passwd → /etc/micronas/webdav.passwd
- _save_credentials creates /etc/micronas/ if missing
- _write_webdav_conf: chown root:www-data on passwd file so Apache can read it
- micronas.service EnvironmentFile updated
- README: credentials now set via /setup, config dir step added

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app.py

@@ -17,7 +17,8 @@ VALID_NAME = re.compile(r'^[A-Za-z0-9_-]+$')
 VALID_NFS_CLIENT = re.compile(r'^[A-Za-z0-9.*:/\-]+$')
 ALLOWED_PATH_BASE = Path('/srv').resolve()
 
-_ENV_FILE = '/etc/micronas.env'
+_CONF_DIR   = '/etc/micronas'
+_ENV_FILE   = '/etc/micronas/micronas.env'
 
 # Mutable credential store — updated by setup/change without restart (single gunicorn worker).
 _creds = {
@@ -48,6 +49,7 @@ def _verify_password(password):
 
 def _save_credentials(user, password):
     h = _hash_password(password)
+    os.makedirs(_CONF_DIR, exist_ok=True)
     Path(_ENV_FILE).write_text(f'MICRONAS_USER={user}\nMICRONAS_PASS_HASH={h}\n')
     os.chmod(_ENV_FILE, 0o600)
     _creds['user']  = user
@@ -291,7 +293,7 @@ def add_nfs_share(path, clients, ro=False):
 # ===== WEBDAV =====
 
 WEBDAV_CONF   = '/etc/apache2/conf-available/micronas-webdav.conf'
-WEBDAV_PASSWD = '/etc/micronas-webdav.passwd'
+WEBDAV_PASSWD = '/etc/micronas/webdav.passwd'
 _WEBDAV_MARK  = 'MICRONAS'
 
 
@@ -340,9 +342,10 @@ def _write_webdav_conf(shares):
         ]
     with open(WEBDAV_CONF, 'w') as f:
         f.writelines(lines)
-    # Ensure the passwd file exists so Apache doesn't 500 before any user has logged in
+    # Ensure passwd file exists and is readable by www-data (Apache) but not world-readable
     if not os.path.exists(WEBDAV_PASSWD):
         Path(WEBDAV_PASSWD).touch(mode=0o640)
+    subprocess.run(['chown', 'root:www-data', WEBDAV_PASSWD], capture_output=True)
     subprocess.run(['a2enconf', 'micronas-webdav'], capture_output=True)
     subprocess.run(['systemctl', 'reload', 'apache2'], capture_output=True)