Implement rootless containers for all services

- backend: appuser UID/GID 1001 via useradd, USER directive, --chown on COPY
- frontend builder: appuser UID/GID 1001 via adduser, USER directive
- frontend prod: switch to nginxinc/nginx-unprivileged:alpine (nginx UID 101), listen on 8080
- docker-compose: explicit user: for all services (70:70 db, 1001:1001 backend/frontend-dev, 101:101 frontend-prod)
- nginx.conf: listen 8080 to match unprivileged image

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.dev.yml

@@ -4,6 +4,7 @@
 services:
 
   backend:
+    user: "1001:1001"
     command: sh scripts/start_dev.sh
     volumes:
       - ./backend:/app
@@ -12,6 +13,7 @@ services:
     build:
       context: ./frontend
       target: builder          # stop at the Node stage, skip nginx
+    user: "1001:1001"
     command: npm run dev -- --host 0.0.0.0
     ports:
       - "5173:5173"