docker: run as non-root, add health check, document upaas (closes #147)

The runtime image runs as uid 10001, which owns /var/lib/dnswatcher. The
working directory is /, so config loading finds no .env or dnswatcher
config file there; the binary lives in /usr/local/bin. A Docker
HEALTHCHECK probes /.well-known/healthcheck every 10 seconds with busybox
wget, so the container is healthy well before upaas reads its health at
60 seconds.

Startup now fails with an error naming the data directory when it cannot
be written, instead of running with every save failing. The check creates
the directory if needed and writes and removes the temp file Save uses.

README gains "Running under upaas": the prod branch, host directory
setup, network and port, environment and health check.

Model: opus-5-5

Dockerfile

@@ -64,8 +64,8 @@ USER dnswatcher
 
 EXPOSE 8080
 
-# busybox wget (already in alpine) probes the health endpoint every 10
+# busybox wget (already in alpine) probes the health endpoint. The first
-# seconds, so the container is healthy well before upaas reads its health
+# probe runs one interval after start. upaas reads the container's health
 # 60 seconds after a deploy and fails the deploy unless it is healthy.
 HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=3 \
     CMD wget -q -O /dev/null "http://127.0.0.1:${PORT:-8080}/.well-known/healthcheck" || exit 1