test: expand server protocol scenario coverage

deploy/production/compose.yaml

@@ -6,6 +6,25 @@
 name: rvbox-server
 
 services:
+  init:
+    image: "${RVBOX_SERVER_IMAGE:?set RVBOX_SERVER_IMAGE to a pinned rvbox-server image}"
+    user: "0:0"
+    entrypoint: ["/bin/sh", "-ec"]
+    command: >-
+      mkdir -p /var/lib/rvbox-server /run/rvbox &&
+      chown 65532:65532 /var/lib/rvbox-server /run/rvbox &&
+      chmod 0700 /var/lib/rvbox-server /run/rvbox
+    read_only: true
+    tmpfs:
+      - /tmp:mode=1777,size=8m
+    volumes:
+      - server-data:/var/lib/rvbox-server
+      - server-run:/run/rvbox
+    security_opt:
+      - no-new-privileges:true
+    cap_drop: ["ALL"]
+    cap_add: ["CHOWN", "FOWNER"]
+
   server:
     image: "${RVBOX_SERVER_IMAGE:?set RVBOX_SERVER_IMAGE to a pinned rvbox-server image}"
     restart: unless-stopped
@@ -18,11 +37,11 @@ services:
         source: ./server.toml
         target: /etc/rvbox/server.toml
         read_only: true
-      - type: bind
-        source: ./state
+      - type: volume
+        source: server-data
         target: /var/lib/rvbox-server
-      - type: bind
-        source: ./run
+      - type: volume
+        source: server-run
         target: /run/rvbox
     expose:
       - "6899"
@@ -36,6 +55,9 @@ services:
     security_opt:
       - no-new-privileges:true
     cap_drop: ["ALL"]
+    depends_on:
+      init:
+        condition: service_completed_successfully
 
   nginx:
     image: nginx:1.27.5-alpine
@@ -66,3 +88,7 @@ services:
       - no-new-privileges:true
     cap_drop: ["ALL"]
     cap_add: ["NET_BIND_SERVICE"]
+
+volumes:
+  server-data:
+  server-run: