Make the image prepare its own data directory (closes #262)

A host directory mounted at /var/lib/neoirc kept the host's owner, so neoircd could not create state.db and stopped at startup.

The image now starts deploy/docker-entrypoint.sh as root. It creates /var/lib/neoirc, gives it and its contents to neoirc with mode 0700, and execs neoircd as neoirc through su-exec. The runtime stage drops USER neoirc and no longer creates the directory at build time.

Judgement call: the entrypoint assumes it starts as root; docker run --user fails at chown.

Model: opus-5-5

deploy/docker-entrypoint.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+# deploy/docker-entrypoint.sh: the image's ENTRYPOINT, run as root. A host
+# directory mounted at /var/lib/neoirc keeps the host's owner, so this gives
+# it to neoirc before running neoircd as neoirc.
+set -eu
+
+main() {
+    mkdir -p /var/lib/neoirc
+    chown -R neoirc:neoirc /var/lib/neoirc
+    chmod 0700 /var/lib/neoirc
+    exec su-exec neoirc neoircd "$@"
+}
+
+main "$@"