support per-item ownership/mode overrides in app_subdirectories; fix dir mode default

roles/app/tasks/setup.yml

@@ -72,15 +72,21 @@
         state: directory
         owner: "{{ app_uid }}"
         group: "{{ app_gid }}"
-        mode: "{{ app_permission_mode }}"
+        mode: "{{ app_dir_mode }}"
 
+    # Items may be plain path strings, or dicts with per-item overrides:
+    #   - /some/path                                  # uses app_uid/app_gid/app_dir_mode
+    #   - path: /some/path                            # same
+    #     owner: 999                                  # per-item overrides for containers
+    #     group: 999                                  # that expect a specific uid/gid
+    #     mode: "0700"
     - name: Create application subdirectories
       ansible.builtin.file:
-        path: "{{ item }}"
+        path: "{{ item.path | default(item) }}"
         state: directory
-        owner: "{{ app_uid }}"
-        group: "{{ app_gid }}"
-        mode: "{{ app_permission_mode }}"
+        owner: "{{ item.owner | default(app_uid) }}"
+        group: "{{ item.group | default(app_gid) }}"
+        mode: "{{ item.mode | default(app_dir_mode) }}"
       loop: "{{ app_subdirectories }}"
   tags: [setup, deploy]