feat(infra): T20 S4 image batch - non-root appuser, compose resource limits, unified extensions init mount (I1/I4)

deploy/app/Dockerfile

@@ -43,11 +43,19 @@ COPY deploy/postgres/goose /app/deploy/postgres/goose
 COPY templates /app/templates
 COPY configs /app/configs
 
+# T20-I1: 非 root 运行（固定 uid/gid 10001，宿主卷需对该 uid 可写）。
+RUN set -eux; \
+    groupadd -g 10001 appuser; \
+    useradd -u 10001 -g appuser -d /app -s /usr/sbin/nologin appuser; \
+    mkdir -p /app/data; \
+    chown -R appuser:appuser /app
+
 ENV DATA_DIR=/app/data \
     HTTP_HOST=0.0.0.0 \
     HTTP_PORT=8080
 
 EXPOSE 8080
+USER appuser
 
 HEALTHCHECK --interval=10s --timeout=5s --retries=6 \
   CMD curl -fsS "http://127.0.0.1:${HTTP_PORT:-8080}/api/v1/health" || exit 1