fix: Phase 7 follow-up bugs — magicmirror, openclaw, ghost dirs (ref #498)

Three small bugs surfaced when auditing the aggregator load after
mass migration on gk2 :

magicmirror : debian/rules installed only api/main.py + an empty
  __init__.py, so the running module's `from .routers import mmpm` had
  no routers/ package to find. Was already broken under its own
  per-module systemd unit. Now ships api/__init__.py from source +
  api/routers/{__init__.py,mmpm.py}.

openclaw : postinst chown'd /var/lib/secubox/openclaw to root:root with
  0750. The Phase 7.D aggregator runs as `secubox`, which couldn't
  traverse the parent dir during the module's import-time mkdir of
  scans/. Now chown to secubox:secubox (when the user exists), 0755 on
  parent, 0750 on scans/ — same containment, traversable by the
  aggregator.

secubox-aggregator-migrate : older packaging shipped some modules under
  /usr/lib/secubox/secubox-<name>/ in addition to the canonical
  /usr/lib/secubox/<name>/. On upgraded systems both coexist and the
  discovery walk picked up duplicates that mounted as empty (no paths)
  sub-apps under /api/v1/secubox-<name>/. Now skipped when an unprefixed
  twin exists.

Live on gk2 : 117 mounted, 0 failed, 4.4 GiB free RAM. magicmirror and
openclaw both return HTTP 200 via nginx.

packages/secubox-aggregator/sbin/secubox-aggregator-migrate

@@ -31,6 +31,13 @@ command -v curl >/dev/null || err "curl required"
 log "Phase 7 ASGI migration — v${VERSION}"
 
 # ── Step 1+2 : Discover modules + write aggregator.toml ──────────────────
+#
+# Older packaging variants installed under /usr/lib/secubox/secubox-<name>/
+# (with the package-name prefix) before being superseded by the canonical
+# unprefixed /usr/lib/secubox/<name>/. Both directories often coexist on
+# upgraded systems. We filter out the `secubox-*` prefixed siblings here :
+# their FastAPIs are byte-identical with the unprefixed ones, so mounting
+# both would just waste memory and create ghost openapi.json entries.
 TOML_TMP=$(mktemp)
 {
     echo "# Phase 7 (#496) — auto-generated by ${MODULE}"
@@ -39,6 +46,16 @@ TOML_TMP=$(mktemp)
     for f in /usr/lib/secubox/*/api/main.py; do
         [ -f "$f" ] || continue
         m=$(basename "$(dirname "$(dirname "$f")")")
+        case "$m" in
+            secubox-*)
+                # legacy prefixed dir — canonical unprefixed twin wins
+                stripped="${m#secubox-}"
+                if [ -f "/usr/lib/secubox/${stripped}/api/main.py" ]; then
+                    log "skip ${m} (duplicate of ${stripped})"
+                    continue
+                fi
+                ;;
+        esac
         printf '    "%s",\n' "$m"
     done
     echo "]"

packages/secubox-magicmirror/debian/rules

@@ -5,7 +5,10 @@
 override_dh_auto_install:
 	install -d $(CURDIR)/debian/secubox-magicmirror/usr/lib/secubox/magicmirror/api
 	install -m 644 api/main.py $(CURDIR)/debian/secubox-magicmirror/usr/lib/secubox/magicmirror/api/
-	touch $(CURDIR)/debian/secubox-magicmirror/usr/lib/secubox/magicmirror/api/__init__.py
+	install -m 644 api/__init__.py $(CURDIR)/debian/secubox-magicmirror/usr/lib/secubox/magicmirror/api/
+	install -d $(CURDIR)/debian/secubox-magicmirror/usr/lib/secubox/magicmirror/api/routers
+	install -m 644 api/routers/__init__.py $(CURDIR)/debian/secubox-magicmirror/usr/lib/secubox/magicmirror/api/routers/
+	install -m 644 api/routers/mmpm.py $(CURDIR)/debian/secubox-magicmirror/usr/lib/secubox/magicmirror/api/routers/
 	install -d $(CURDIR)/debian/secubox-magicmirror/usr/share/secubox/www/magicmirror
 	install -m 644 www/magicmirror/index.html $(CURDIR)/debian/secubox-magicmirror/usr/share/secubox/www/magicmirror/
 	install -d $(CURDIR)/debian/secubox-magicmirror/etc/nginx/secubox.d

packages/secubox-openclaw/debian/postinst

@@ -1,11 +1,18 @@
 #!/bin/sh
 set -e
 if [ "$1" = "configure" ]; then
-    # Create data directories
+    # Create data directories. The openclaw FastAPI imports a module that
+    # touches /var/lib/secubox/openclaw/scans at import time, so the user
+    # that loads it MUST be able to traverse the parent dir. Under
+    # Phase 7.D (secubox-aggregator) the loader runs as `secubox`, not
+    # root — so the parent dir is 0755 and owned by `secubox:secubox`.
     mkdir -p /var/lib/secubox/openclaw/scans
     mkdir -p /var/cache/secubox/openclaw
-    chown -R root:root /var/lib/secubox/openclaw
-    chmod 750 /var/lib/secubox/openclaw
+    if getent passwd secubox >/dev/null; then
+        chown -R secubox:secubox /var/lib/secubox/openclaw /var/cache/secubox/openclaw
+    fi
+    chmod 0755 /var/lib/secubox/openclaw
+    chmod 0750 /var/lib/secubox/openclaw/scans
 
     # Enable and start service
     systemctl daemon-reload