Fix bind-mount data dir permissions via entrypoint

Docker creates ./data root-owned on the host, but the app runs as the unprivileged node user, causing SQLITE_CANTOPEN on first deploy. New entrypoint starts as root, chowns DATA_DIR, then drops privileges with setpriv. Compose keeps the SQLite database in ./data next to the compose file. Also trims scripts/ and playwright artifacts from the image.

docker-entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -e
+
+# Bind-mounted data directories (e.g. ./data next to the compose file) are
+# created root-owned by Docker, but the app runs as the unprivileged `node`
+# user. When we start as root: fix ownership of DATA_DIR, then drop
+# privileges. When started with a custom --user, just run as-is.
+DATA_DIR="${DATA_DIR:-/app/data}"
+
+if [ "$(id -u)" = "0" ]; then
+  mkdir -p "$DATA_DIR"
+  chown -R node:node "$DATA_DIR"
+  exec setpriv --reuid=node --regid=node --init-groups "$@"
+fi
+
+exec "$@"