fix(docker): fix EACCES on runtime data dir

- add docker-entrypoint.sh that creates and chowns /app/data at startup
- run as nextjs via su-exec after fixing directory ownership
- handle root-owned named volumes created by earlier images

README.md

@@ -74,6 +74,10 @@ Notes:
 
 - Image uses Next.js `output: "standalone"` and `pnpm` in multi-stage build.
 - Runtime data is written to `/app/data/prototypes`; mount a volume to persist uploads.
+- A `docker-entrypoint.sh` runs as root at container start, ensures `/app/data/prototypes`
+  exists and is owned by the app user, then drops to the unprivileged `nextjs` user. This
+  avoids `EACCES` errors even when the volume was created by an earlier image as root —
+  no need to delete the existing volume when upgrading.
 
 ## Upload Requirements