fix(docker): run the dev container as non-root

[WhiteMuush]

Closes #39 (closed manually on merge, closing keywords do not apply to develop).

Finding

Trivy DS-0002 (HIGH): Dockerfile.dev had no USER, so next dev ran as root inside the development container. The production image already runs unprivileged.

Fix

• Dockerfile.dev switches to the image's node user (uid 1000) before installing dependencies, and copies files owned by it.
• compose.yml runs the app as ${APP_UID:-1000}:${APP_GID:-1000}, since that user must own the bind-mounted source; a host user other than 1000 sets both variables.

Verified

• Image built; the container runs as node, /app and node_modules owned by node.
• With the source bind-mounted, next dev starts and serves /login (200) and /dashboard (307 without session); files it writes stay owned by the host user, no permission error.
• Trivy config scan: no HIGH or CRITICAL left.
• make check green.

Not fixed here

docker compose up runs npm run seed:dev, whose prisma/seed.dev.ts is untracked (private since #165). On a fresh clone the app command fails before next dev. Reported separately; the test above started next dev directly.