Align all app containers to UID 1001, add infra protocol, update README

- frontend prod: USER root for adduser, then USER appuser (1001:1001); fixes
  build failure caused by nginx-unprivileged already setting USER nginx
- docker-compose: frontend user updated to 1001:1001 (was 101:101)
- CLAUDE.md: add infrastructure change protocol (update README + test both
  stacks after any Dockerfile/compose/nginx change); fix stale passlib ref
- README: container table shows nginx-unprivileged image, UID column, internal
  port 8080 note; Current State notes all containers run as non-root

Both dev and prod stacks tested and verified (health, login, /users/me,
frontend serving, all containers confirmed non-root via docker inspect).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -42,7 +42,7 @@ services:
       context: ./frontend
       dockerfile: Dockerfile
       network: host
-    user: "101:101"  # nginx user UID:GID in nginx-unprivileged:alpine
+    user: "1001:1001"
     restart: unless-stopped
     ports:
       - "80:8080"