observability: run prometheus/loki/grafana as 1000:1000 (rootless uid mapping)

Container root maps to a subuid that owns nothing under /opt, so the
data-dir writes fail. Container uid 1000 is the invoking user in
rootless podman.

tests/caddyfile.bats

@@ -118,3 +118,18 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
 @test "prometheus targets are host:port (no URL schemes)" {
     ! grep -nE '^\s*-\s*"?http' "$REPO_ROOT/shared/prometheus/prometheus.yml"
 }
+
+@test "observability containers run as the host user (rootless uid mapping)" {
+    # Rootless podman maps container uid 1000 to the invoking user, so
+    # 1000:1000 lets these containers write their /opt data dirs. Container
+    # root would map to a subuid that owns nothing under /opt.
+    local compose="$REPO_ROOT/dankclaw/compose.yaml"
+    local svc
+    for svc in prometheus loki grafana; do
+        local block
+        block=$(awk "/^  $svc:$/,/^  [a-z]/" "$compose" | grep -v "^  $svc:")
+        echo "$block" | grep -q 'user: "1000:1000"' || {
+            echo "service $svc does not run as user 1000:1000"; return 1;
+        }
+    done
+}