Fix bind-mount data dir permissions via entrypoint

Docker creates ./data root-owned on the host, but the app runs as the unprivileged node user, causing SQLITE_CANTOPEN on first deploy. New entrypoint starts as root, chowns DATA_DIR, then drops privileges with setpriv. Compose keeps the SQLite database in ./data next to the compose file. Also trims scripts/ and playwright artifacts from the image.

docker-compose.yml

@@ -4,7 +4,9 @@ services:
     ports:
       - "3000:3000"
     volumes:
-      # SQLite database persists on the host across container rebuilds.
+      # SQLite database lives in ./data next to this compose file and
+      # persists across container rebuilds. The entrypoint fixes ownership
+      # automatically (the app itself runs as the unprivileged `node` user).
       - ./data:/app/data
     environment:
       # CHANGE THIS: set a long random string before exposing the app.