Merge pull request 'hardening: run production container as non-root user' (#19) from mailship-c3s-docker-run-production-container-as-non-r-4e7 into main

Reviewed-on: #19
Reviewed-by: matt <matt@lorentz.is>

Dockerfile

@@ -52,6 +52,12 @@ COPY --from=build /app/src/emails/ ./dist/emails/
 # Create data directory for SQLite
 RUN mkdir -p /data
 
+# Create non-root user for security hardening
+RUN addgroup -S app && adduser -S -G app app
+RUN chown -R app:app /data
+
+USER app
+
 EXPOSE 4738
 
 ENV NODE_ENV=production