fix: resolve 6 production Sentry errors

- Prevent @fastify/static double-registration crash via decorateReply guard
- Fix non-ASCII filename header encoding (X-Output-Filename + RFC 5987 Content-Disposition)
- Add EACCES error handling to all startup mkdir calls with actionable messages
- Add WAL autocheckpoint and journal size limit to prevent unbounded SQLite growth
- Fix Python sidecar EPIPE handling to reject pending requests and trigger restart
- Ensure Docker entrypoint creates all subdirectories before chown

apps/api/src/lib/feature-status.ts

@@ -41,9 +41,20 @@ export function getManifestPath(): string {
 
 export function ensureAiDirs(): void {
   if (!isDockerEnvironment()) return;
-  mkdirSync(join(AI_DIR, "venv"), { recursive: true });
-  mkdirSync(MODELS_DIR, { recursive: true });
-  mkdirSync(join(AI_DIR, "pip-cache"), { recursive: true });
+  try {
+    mkdirSync(join(AI_DIR, "venv"), { recursive: true });
+    mkdirSync(MODELS_DIR, { recursive: true });
+    mkdirSync(join(AI_DIR, "pip-cache"), { recursive: true });
+  } catch (err: unknown) {
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code === "EACCES") {
+      console.error(
+        `WARNING: Cannot create AI directories under "${AI_DIR}". AI features will be unavailable. Check volume permissions (PUID/PGID).`,
+      );
+      return;
+    }
+    throw err;
+  }
 }
 
 // ── Docker detection ────────────────────────────────────────────────────