Tighten authorized_keys after installing a key, since sshd ignores a world-writable one and says nothing to the installer

Partnership/ssh_setup.sh

@@ -455,6 +455,22 @@ else
     if ssh-copy-id -i "$SSH_PUB_PATH" -o ConnectTimeout="${SSH_TIMEOUT:-15}" \
         root@"$REMOTE_SERVER" 2>/dev/null; then
         echo "Public key installed on $REMOTE_SERVER_NAME ✅"
+
+        # Tighten the file ssh-copy-id just wrote, or the key it installed is inert.
+        #
+        # On Unraid /root/.ssh is a symlink to /boot/config/ssh/root, and a file created there
+        # comes out 0666. sshd runs StrictModes by default and refuses to read a group- or
+        # world-writable authorized_keys — it logs "Authentication refused: bad ownership or
+        # modes" and falls through to password auth, which BatchMode then declines.
+        #
+        # The failure is silent from this end: ssh-copy-id succeeds and reports success, the key
+        # is present and byte-correct, and every later connection is still refused. Observed
+        # exactly that — key installed at 07:15:12, onboard refused at 07:15:43, blobs identical.
+        ssh -o ConnectTimeout="${SSH_TIMEOUT:-15}" -o BatchMode=yes -o StrictHostKeyChecking=no \
+            -i "$SSH_KEY_PATH" root@"$REMOTE_SERVER" \
+            'chmod 700 "$(dirname "$(readlink -f ~/.ssh/authorized_keys)")" 2>/dev/null
+             chmod 600 "$(readlink -f ~/.ssh/authorized_keys)" 2>/dev/null' 2>/dev/null \
+          || warn "Could not tighten authorized_keys on $REMOTE_SERVER_NAME — if auth is refused, chmod 600 it there"
     else
         error "ssh-copy-id failed — check that:"
         error "  1. Remote server is reachable: tailscale status"