add hannah smb user, fix music dir permissions

RUNBOOK.md

@@ -130,9 +130,11 @@ done
 
 # Shared music dir. Lives inside the media dataset (so it rides the media
 # snapshot policy) but is exported as its own writable [music] share.
-# setgid so files dropped in over SMB inherit sambagroup and stay readable
-# by the Navidrome container.
-install -d -o timothykim -g sambagroup -m 2775 /opt/argento/smb/media/Music
+# No chmod: threeteras/media is acltype=nfsv4 aclmode=restricted, so chmod
+# fails with EPERM. aclinherit=passthrough already copies the parent's ACL
+# onto the new dir, which is what grants sambagroup write.
+mkdir -p /opt/argento/smb/media/Music
+chown timothykim:sambagroup /opt/argento/smb/media/Music
 
 # SELinux contexts for samba — fresh ZFS datasets get unlabeled_t and samba
 # refuses to serve them. Persistent rules (semanage) survive full relabels;
@@ -153,7 +155,7 @@ so file ownership lands on the correct UIDs.
 /opt/argento/scripts/restore-users.sh
 ```
 
-This recreates timothykim, yireh, isaac, and the sambagroup group with
+This recreates timothykim, yireh, isaac, hannah, and the sambagroup group with
 their original UIDs/GIDs, then restores the samba password hashes from
 `/mnt/backup/argento/system/samba-private/` if present (mirrored there
 by sync-system.sh, gitignored so the hashes aren't in version control).
@@ -161,7 +163,7 @@ by sync-system.sh, gitignored so the hashes aren't in version control).
 If the samba passdb backup is missing, set passwords manually:
 
 ```bash
-for u in timothykim yireh isaac; do
+for u in timothykim yireh isaac hannah; do
     smbpasswd -a "$u"
     smbpasswd -e "$u"
 done