Fix bind-mount data dir permissions via entrypoint

Docker creates ./data root-owned on the host, but the app runs as the unprivileged node user, causing SQLITE_CANTOPEN on first deploy. New entrypoint starts as root, chowns DATA_DIR, then drops privileges with setpriv. Compose keeps the SQLite database in ./data next to the compose file. Also trims scripts/ and playwright artifacts from the image.

README.md

@@ -32,13 +32,17 @@ services:
     environment:
       SESSION_SECRET: "<long random string — e.g. openssl rand -hex 32>"
     volumes:
-      - ./data:/app/data
+      - ./data:/app/data      # database lives next to this compose file
     # No public port mapping needed when Caddy shares a Docker network with
     # the app (recommended). For a host-level Caddy, map localhost only:
     ports:
       - "127.0.0.1:3000:3000"
 ```
 
+The entrypoint chowns `./data` to the app's unprivileged `node` user on
+startup, so a root-created bind-mount directory works out of the box. (Images
+older than this note need a one-time `sudo chown -R 1000:1000 ./data`.)
+
 ```bash
 docker compose up -d
 ```
@@ -108,7 +112,7 @@ npm test         # API tests (node:test + supertest)
 
 ## Data
 
-All state lives in a single SQLite file under `DATA_DIR`. In Docker this is `/app/data`, mounted from `./data` on the host. No external database or services are required (geocoding calls OpenStreetMap's Nominatim, which needs no API key; airport lookups use a bundled offline dataset).
+All state lives in a single SQLite file under `DATA_DIR`. In Docker this is `/app/data`, bind-mounted from `./data` next to the compose file — back up that directory to back up all trips. No external database or services are required (geocoding calls OpenStreetMap's Nominatim, which needs no API key; airport lookups use a bundled offline dataset).
 
 ## Documentation