fix(docker): fix EACCES on runtime data dir

- add docker-entrypoint.sh that creates and chowns /app/data at startup
- run as nextjs via su-exec after fixing directory ownership
- handle root-owned named volumes created by earlier images

docker-entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+
+# Runs as root at container start. Ensures the runtime data directory
+# exists and is owned by the app user, then drops privileges and runs
+# the app. This fixes the case where /app/data is a named/bind volume
+# created by an earlier image and therefore owned by root (EACCES on
+# mkdir /app/data/prototypes).
+
+if [ "$(id -u)" -eq 0 ]; then
+  mkdir -p /app/data/prototypes
+  chown -R nextjs:nodejs /app/data
+  exec su-exec nextjs:nodejs "$@"
+fi
+
+exec "$@"