fix: allow containers to run as non-root user (UID 1000)

- chown public/, dist/, and scripts/ to node:node after build
- add USER node directive before EXPOSE in dist-mono and dist-arm Dockerfiles
- update CMD to exec form in dist-mono for consistency

Fixes running the container with --user 1000 in environments that
don't allow containers to run as root. The sed -i in inject-vars.sh
requires write permission on ./public/assets/, which previously
failed with 'Permission denied' when running as non-root.

The node user (UID 1000) is built into the node:20-slim base image.
Existing root deployments are unaffected.

docker/dist-arm/server.Dockerfile

@@ -40,6 +40,12 @@ RUN npm run build
 
 COPY --from=frontend-build /app/client/dist ./public
 
+RUN chown -R node:node ./public \
+    && chown -R node:node ./dist \
+    && chown -R node:node ./scripts
+
+USER node
+
 EXPOSE 52345
 
 CMD ["sh", "-c", "./scripts/inject-vars.sh && node ./dist/index.js"]

docker/dist-mono/server.Dockerfile

@@ -26,8 +26,13 @@ RUN cp -r src/templates dist/templates
 
 COPY --from=frontend-build /app/client/dist ./public
 
-RUN chmod +x ./scripts/inject-vars.sh
+RUN chmod +x ./scripts/inject-vars.sh \
+    && chown -R node:node ./public \
+    && chown -R node:node ./dist \
+    && chown -R node:node ./scripts
+
+USER node
 
 EXPOSE 52345
 
-CMD ./scripts/inject-vars.sh && node ./dist/index.js
+CMD ["sh", "-c", "./scripts/inject-vars.sh && node ./dist/index.js"]