Allow existing NAS photo read group and reject unreadable catalogs

docs/PHOTO_SOURCES.md

@@ -10,6 +10,8 @@ Add the actual existing photo directory to `.env`:
 
 ```dotenv
 NAS_PHOTOS_DIR=/volume2/photo
+# Optional: existing NAS group allowed to read that folder (check its ACL).
+# NAS_PHOTOS_GID=101
 ```
 
 The path above is an example, not a detected directory. Enable the optional mount:
@@ -20,7 +22,12 @@ docker compose -f docker-compose.yml -f deploy/docker-compose.photos.yml up -d
 ```
 
 The folder is mounted **read-only** at `/photos`. The existing container user must
-already have read/traverse permission. Frame Flow does not change NAS permissions.
+already have read/traverse permission. If the Synology ACL grants a group access,
+set `NAS_PHOTOS_GID` to that existing group ID; the optional Compose overlay adds
+only container group membership, keeping UID 10333 and the photo bind mount read-only.
+Group 101 is a deployment example, not a universal default. Frame Flow does not
+change NAS permissions. Unreadable roots return an explicit HTTP 403 rather than
+an empty catalog.
 Missing host folders fail explicitly rather than being created automatically.
 
 Open **Gallery → Photo sources → Add source**, choose **NAS local folder**,