fix: handle volume permission issues for bind-mounted /data directory

Adds a gosu-based entrypoint that starts as root, fixes ownership of
/data and /tmp/workspace for the stirling user, then drops privileges.
This fixes "SQLITE database not found" errors when users bind-mount
host directories.

docker/Dockerfile

@@ -52,6 +52,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     build-essential \
     libgl1 libglib2.0-0 \
+    gosu \
     && rm -rf /var/lib/apt/lists/*
 
 # Create Python venv and install ML packages
@@ -143,15 +144,18 @@ ENV PORT=1349 \
     MAX_MEGAPIXELS=100 \
     RATE_LIMIT_PER_MIN=100
 
-# Run as non-root user for security
+# Create non-root user for runtime
 RUN groupadd -r stirling && useradd -r -g stirling -d /app -s /sbin/nologin stirling
 RUN chown -R stirling:stirling /app /data /tmp/workspace /opt/venv
-USER stirling
+
+# Entrypoint fixes volume permissions then drops to stirling via gosu
+COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
 
 EXPOSE 1349
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
     CMD curl -f http://localhost:1349/api/v1/health || exit 1
 
-# Use tsx to run TypeScript source directly (handles workspace package resolution)
+ENTRYPOINT ["entrypoint.sh"]
 CMD ["npx", "tsx", "apps/api/src/index.ts"]

docker/entrypoint.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+# Fix ownership of mounted volumes so the non-root stirling user can write.
+# This runs as root, fixes permissions, then drops to stirling via gosu.
+if [ "$(id -u)" = "0" ]; then
+  chown -R stirling:stirling /data /tmp/workspace 2>/dev/null || true
+  exec gosu stirling "$@"
+fi
+
+# Already running as stirling (e.g. Kubernetes runAsUser)
+exec "$@"