rename() needs write permission on the DIRECTORY; without it rotation
fails silently while appends succeed, growing log.txt unbounded.
Documents the correct ownership/mode, the health check, and the
Nov 2021 - Jul 2026 production incident (945MB log.txt filled the
15GB disk and truncated a Solr reindex). Also notes that these logs
contain raw authenticate() passwords and must be treated as secrets.
