fix(deploy): group_add lp (gid 7) so the server can write the USB printer node

USB passthrough (1ea1aa4) made /dev/usb/lp1 visible in the container, but the node
is `crw-rw---- root:lp` (660) and the server runs as the non-root `app` user, not in
`lp` — so open(O_WRONLY) → EACCES → printer still "offline". Add the host's `lp` GID
(7 on this Ubuntu booth, verified `getent group lp` → lp:x:7:) via group_add, so the
app process gains the supplementary group that owns the node. Least-privilege: no
world-writable device, no root, no image rebuild. (If a future booth's lp GID differs,
update the number.)

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

docker-compose.prod.yml

@@ -60,6 +60,15 @@ services:
     #     open(). `180:*` covers lp0/lp1/lp2… so a USB replug/boot-order renumber still works
     #     (the printer's path can move; set Connection=USB + the matching /dev/usb/lpN in setup).
     # (Bind-mounting the dir, not a single `devices:` node, is what survives renumbering.)
+    #
+    # ...AND access: the lpN node is `crw-rw---- root:lp` (mode 660). The server runs as the
+    # non-root `app` user, which is NOT in `lp`, so open(O_WRONLY) → EACCES → still "offline".
+    # group_add the HOST's `lp` GID (numeric — `getent group lp`, typically 7 on Debian/Ubuntu)
+    # so the app process gains that supplementary group and can write the 660 node. Least-
+    # privilege (no world-writable device, no root, no rebuild). VERIFY the GID on the booth;
+    # if the host's lp GID differs, change the number here.
+    group_add:
+      - "7"
     volumes:
       - /dev/usb:/dev/usb
     device_cgroup_rules: