fix: restore privileged agent runtime semantics

nix/module.nix

@@ -93,6 +93,24 @@ EOF
     update_control_value MANAGED_PORT ${lib.escapeShellArg (toString cfg.port)}
     update_control_value MANAGED_ENTRANCE ${lib.escapeShellArg cfg.securityEntrance}
     update_control_value MANAGED_VERSION ${lib.escapeShellArg (cfg.package.version or "unknown")}
+
+    # nPanel 2.0.0-2.0.1 ran the agent with UMask=0077. Application archives
+    # were therefore extracted with root-only database configuration files,
+    # even when the public archive declared mode 0644. Repair only the known
+    # non-secret database server configuration files; never relax .env files,
+    # credentials, private keys, or the rest of the mutable application tree.
+    for app_root in \
+      "$state_dir/1panel/apps" \
+      "$state_dir/1panel/resource/apps"
+    do
+      if [ -d "$app_root" ]; then
+        find "$app_root" -type f \
+          \( -path '*/mysql/*/conf/my.cnf' \
+             -o -path '*/mysql-cluster/*/conf/my.cnf' \
+             -o -path '*/mariadb/*/conf/my.cnf' \) \
+          -exec chmod 0644 {} +
+      fi
+    done
   '';
 
   commonServiceConfig = {
@@ -114,12 +132,10 @@ EOF
 
     Restart = "on-failure";
     RestartSec = "5s";
-    UMask = "0077";
-    PrivateTmp = true;
-    ProtectSystem = "full";
-    ProtectHome = false;
-    PrivateDevices = false;
-    NoNewPrivileges = false;
+    # The upstream agent is a privileged host-management daemon. Its
+    # application ecosystem relies on the conventional service umask so
+    # non-root processes inside containers can read public configuration.
+    UMask = "0022";
   };
 in
 {

nix/package.nix

@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "2.0.1";
+  version = "2.0.2";
 
   frontend = buildNpmPackage {
     pname = "npanel-frontend";