Make the image prepare its own data directory (closes #262)

A host directory mounted at /var/lib/neoirc kept the host's owner, so
neoircd could not create state.db. The image now starts as root in
deploy/docker-entrypoint.sh, which creates /var/lib/neoirc, gives it to
neoirc with mode 0700, and runs neoircd as neoirc through su-exec.

Model: opus-5-5

README.md

@@ -1781,13 +1781,17 @@ NEOIRC_HASHCASH_BITS=20
 the linter first and stops when either fails. The image:
 
 - is Alpine with the `neoircd` binary and CA certificates;
-- runs as the user `neoirc`;
+- runs `neoircd` as the user `neoirc`;
 - exposes ports 8080 and 6667;
 - keeps its database in `/var/lib/neoirc`;
 - has a `HEALTHCHECK` that calls `/.well-known/healthcheck.json` every 30
   seconds.
 
-Run it with a volume for the database and the settings as environment variables:
+The image prepares `/var/lib/neoirc` itself on every start. It creates the
+directory, gives it to `neoirc` and then runs `neoircd` as `neoirc`.
+
+Run it with a named volume for the database and the settings as environment
+variables:
 
 ```bash
 docker run -d --name neoirc \
@@ -1798,6 +1802,17 @@ docker run -d --name neoirc \
   neoirc
 ```
 
+A host directory works the same way in place of the named volume:
+
+```bash
+docker run -d --name neoirc \
+  -p 8080:8080 -p 6667:6667 \
+  -v /srv/neoirc:/var/lib/neoirc \
+  -e SERVER_NAME="My Server" \
+  -e MOTD="Welcome!" \
+  neoirc
+```
+
 ### Reverse proxy
 
 Run the server behind a reverse proxy that terminates TLS. The server itself
@@ -1959,6 +1974,8 @@ and their sessions to end. Then it closes the database.
 - `schema/`: JSON Schema files for the message envelope, with their own
   `README.md`.
 - `script/`: the entrypoints below.
+- `deploy/`: `docker-entrypoint.sh`, the image's entrypoint, which prepares
+  `/var/lib/neoirc` and starts `neoircd` as `neoirc`.
 - `CONVENTIONS.md`, `REPO_POLICIES.md` and `AGENTS.md`: the architecture
   conventions, the repository policies and the rules for coding agents.