Add non-root user to Dockerfile

[pscheid92]

Summary

• Adds a non-root appuser to the runtime stage of the Dockerfile
• Sets USER appuser before the entrypoint so the container no longer runs as root
• Reduces blast radius of a potential container escape

Test plan

• make docker-build succeeds
• make docker-up starts and app functions normally
• docker exec <container> whoami returns appuser

🤖 Generated with Claude Code