fix(docker): run container as non-root user (least privilege)

No USER directive meant uvicorn ran as root (uid 0). Add an
unprivileged `appuser` (uid 10001) and switch to it before CMD. The
app binds 8000 (>1024) so root isn't needed; app files stay root-owned
and read-only to appuser. Verified the image runs as uid 10001 and
/api/MarkAccent/ still returns 200.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: torrid-fish

Dockerfile

@@ -19,6 +19,11 @@ RUN python -m compileall -b -q main.py api config \
 
 FROM python:3.11-slim
 
+# Least privilege: run as an unprivileged user, not root. The app binds
+# port 8000 (>1024) so no root is needed. App files stay root-owned and
+# read-only to this user — the process can't modify its own code or deps.
+RUN useradd --system --no-create-home --uid 10001 appuser
+
 WORKDIR /app
 
 # Copy installed dependencies and app from builder
@@ -33,4 +38,6 @@ ENV PYTHONUNBUFFERED=1
 
 EXPOSE 8000
 
+USER appuser
+
 CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]