fix: worker logs permission denied + migration AFTER password

Dockerfile.worker

@@ -7,6 +7,7 @@ ENV TZ=America/Bogota
 # Instalar dependencias
 RUN apk add --no-cache \
     bash \
+    su-exec \
     libzip \
     libzip-dev \
     icu \
@@ -59,10 +60,13 @@ RUN if [ -f composer.json ]; then \
 # Dar permisos
 RUN chmod +x worker.php
 
+# Entrypoint: arregla permisos del volumen montado y ejecuta como www
+COPY docker/worker-entrypoint.sh /usr/local/bin/worker-entrypoint.sh
+RUN chmod +x /usr/local/bin/worker-entrypoint.sh
+
 # Health check
 HEALTHCHECK --interval=60s --timeout=5s --start-period=30s --retries=3 \
     CMD pgrep -f "worker.php" || exit 1
 
-USER www
+ENTRYPOINT ["/usr/local/bin/worker-entrypoint.sh"]
-
 CMD ["php", "worker.php", "--daemon"]

database/06_master_sync.sql

@@ -164,7 +164,7 @@ CREATE TABLE IF NOT EXISTS `lab_config` (
 -- C1) COLUMNA: admin_users.role_id  (prod → local / instalaciones nuevas)
 -- =============================================================================
 ALTER TABLE `admin_users`
-  ADD COLUMN IF NOT EXISTS `role_id` int(11) DEFAULT NULL AFTER `password`;
+  ADD COLUMN IF NOT EXISTS `role_id` int(11) DEFAULT NULL;
 
 -- C1a) FK opcional: se añade solo si no existe ya
 -- (MariaDB/MySQL 10.x: ADD CONSTRAINT IF NOT EXISTS no es estándar,

docker/worker-entrypoint.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+# Entrypoint del worker: arregla permisos del volumen montado y ejecuta como www
+
+mkdir -p /var/www/html/logs /var/www/html/uploads
+chown -R www:www /var/www/html/logs /var/www/html/uploads
+chmod -R 775 /var/www/html/logs /var/www/html/uploads
+
+exec su-exec www "$@"