Align all app containers to UID 1001, add infra protocol, update README

- frontend prod: USER root for adduser, then USER appuser (1001:1001); fixes
  build failure caused by nginx-unprivileged already setting USER nginx
- docker-compose: frontend user updated to 1001:1001 (was 101:101)
- CLAUDE.md: add infrastructure change protocol (update README + test both
  stacks after any Dockerfile/compose/nginx change); fix stale passlib ref
- README: container table shows nginx-unprivileged image, UID column, internal
  port 8080 note; Current State notes all containers run as non-root

Both dev and prod stacks tested and verified (health, login, /users/me,
frontend serving, all containers confirmed non-root via docker inspect).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/Dockerfile

@@ -15,9 +15,16 @@ RUN npm ci
 COPY --chown=appuser:appuser . .
 RUN npm run build
 
-# ── Stage 2: serve with nginx (unprivileged, UID 101) ─────────────────────────
+# ── Stage 2: serve with nginx (unprivileged, UID 1001) ────────────────────────
 FROM nginxinc/nginx-unprivileged:alpine
 
+# nginx-unprivileged already sets USER nginx (101). Step up to root only for
+# user creation, then drop back. All nginx writable paths go through /tmp
+# (world-writable) so appuser can run the server without extra chowns.
+USER root
+RUN addgroup -g 1001 appuser && adduser -u 1001 -G appuser -D appuser
+USER appuser
+
 COPY --from=builder /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf