Add logs directory bind mount with entrypoint permission fix

- Add ./logs:/app/logs volume mount to docker-compose.yaml for log access
  - Create entrypoint.sh script that fixes directory ownership at startup
  - Install gosu in Dockerfile for secure privilege dropping
  - Use ENTRYPOINT to run permission fix as root, then drop to krawl user

  This ensures bind-mounted directories have correct permissions even when
  Docker creates them as root on the host.

entrypoint.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+set -e
+
+# Fix ownership of mounted directories
+chown -R krawl:krawl /app/logs /app/data 2>/dev/null || true
+
+# Drop to krawl user and run the application
+exec gosu krawl "$@"