Fix venv ownership when setup runs as sudo

- setup-pi.sh: create venv as real user and chown after pip install
- dw update: detect and fix root-owned .venv from legacy installs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dw

@@ -150,6 +150,12 @@ cmd_update() {
         fi
     fi
 
+    # Fix venv ownership if created by sudo (legacy installs)
+    if [[ -d ".venv" ]] && [[ "$(stat -c '%U' .venv 2>/dev/null)" == "root" ]]; then
+        echo "Fixing .venv ownership..."
+        sudo chown -R "$USER:$USER" .venv
+    fi
+
     echo "Updating Python dependencies..."
     source .venv/bin/activate
     pip install -r requirements.txt

setup-pi.sh

@@ -242,8 +242,13 @@ deploy_native() {
 
     cd "$INSTALL_DIR"
 
-    # Create venv
-    python3 -m venv .venv
+    # Create venv — if running as root (sudo), create as the real user
+    local real_user="${SUDO_USER:-$USER}"
+    if [[ $EUID -eq 0 && -n "$SUDO_USER" ]]; then
+        sudo -u "$SUDO_USER" python3 -m venv .venv
+    else
+        python3 -m venv .venv
+    fi
     source .venv/bin/activate
 
     # Install dependencies
@@ -251,6 +256,11 @@ deploy_native() {
     pip install --upgrade pip
     pip install -r requirements.txt
 
+    # Ensure venv is owned by the real user (not root)
+    if [[ $EUID -eq 0 && -n "$SUDO_USER" ]]; then
+        chown -R "$SUDO_USER:$SUDO_USER" .venv
+    fi
+
     # Ensure nginx (www-data) can traverse to static files
     # chmod o+x grants traversal only, not directory listing
     local dir="$INSTALL_DIR"