fix: resolve runtime model path mismatch for non-root Docker user

Set U2NET_HOME=/opt/models/rembg so rembg models pre-downloaded at
build time as root are found at runtime by the non-root ashim user.
Without this every fresh container re-downloaded the 973 MB BiRefNet
models on first background-removal request.

Apply the same fix to PaddleOCR: download to /opt/models/paddlex and
symlink into both /root/.paddlex and /app/.paddlex so PaddleX finds
models regardless of which HOME gosu resolves at runtime.

Fall back to per-request spawning in bridge.ts when the persistent
dispatcher crashes mid-request (e.g. OOM loading a large ONNX model),
so the operation succeeds instead of surfacing "Python dispatcher
exited unexpectedly" to the user.

Improve entrypoint.sh permission warning to mention Windows bind mounts
as the likely cause.

docker/entrypoint.sh

@@ -11,7 +11,7 @@ export DEFAULT_PASSWORD="${DEFAULT_PASSWORD:-admin}"
 # This runs as root, fixes permissions, then drops to ashim via gosu.
 if [ "$(id -u)" = "0" ]; then
   chown -R ashim:ashim /data /tmp/workspace 2>&1 || \
-    echo "WARNING: Could not fix volume permissions. If processing fails, check your volume mount permissions." >&2
+    echo "WARNING: Could not fix volume permissions. Use named volumes (not Windows bind mounts) to avoid this. See docs for details." >&2
   exec gosu ashim "$@"
 fi