fix: add non-root user and healthcheck to Dockerfile

- Add botfights system user/group, chown /app, USER directive
- Add HEALTHCHECK using /api/health endpoint (30s interval, 5s timeout)
- Container now runs as non-root for security hardening

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile

@@ -39,10 +39,19 @@ COPY --from=build-fe /app/frontend/dist server/public
 
 # Data volume for SQLite
 RUN mkdir -p /app/server/data
+
+# Non-root user
+RUN groupadd --system botfights && useradd --system --gid botfights botfights \
+    && chown -R botfights:botfights /app
+USER botfights
+
 VOLUME /app/server/data
 
 ENV NODE_ENV=production
 ENV PORT=9100
 EXPOSE 9100
 
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD node -e "fetch('http://localhost:9100/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"
+
 CMD ["node", "--max-old-space-size=256", "server/dist/index.js"]