fix(docker): fix EACCES on runtime data dir

- add docker-entrypoint.sh that creates and chowns /app/data at startup
- run as nextjs via su-exec after fixing directory ownership
- handle root-owned named volumes created by earlier images

Dockerfile

@@ -32,7 +32,15 @@ COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 RUN mkdir -p /app/data/prototypes \
   && chown -R nextjs:nodejs /app/data
 
-USER nextjs
+# The entrypoint runs as root at startup so it can fix ownership of
+# /app/data even when it is a volume created by an earlier image,
+# then drops to the unprivileged `nextjs` user via su-exec.
+RUN apk add --no-cache su-exec
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh \
+  && chmod +x /usr/local/bin/docker-entrypoint.sh
+
 EXPOSE 3000
 
+ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["node", "server.js"]