fix(orchestration): update existing user/group UID/GID instead of skipping

The CI base image (built without USER_UID/USER_GID build-args, see !416 (merged)) always bakes in a user account at UID/GID 1000. Downstream environment builds (juice-device, juice-singleuser, ...) are FROM that base image and pass the real host UID/GID via build-arg, but the account-creation guard only ran useradd/groupadd when the account didn't already exist -- since it's inherited from the base layer, the override was silently a no-op and the build kept running as UID 1000, unable to write into the host-owned ~/shared mount.

Use usermod/groupmod to update the existing account when present but mismatched, instead of skipping creation outright.

Closes #397 (closed)