fix: container sets up its own data directory (closes #75)

bin/entrypoint.sh, still running as root, now creates DATA_DIR if
missing and gives it and /data to the netwatch user with mode 750
before starting the backend as that user. It stops the start instead
when a symbolic link is on the path to /data or DATA_DIR, since chown
and chmod would change what the link points to. An empty host
directory owned by root, or one holding files from another uid, works
with no step on the host, so the README no longer tells the operator
to create or chown it. The image no longer sets that ownership at
build time.

Model: opus-5-5

Dockerfile

@@ -77,8 +77,9 @@ COPY --from=frontend /app/dist /usr/share/nginx/html
 COPY --from=builder /src/netwatch-server /usr/local/bin/netwatch-server
 COPY bin/entrypoint.sh /usr/local/bin/entrypoint.sh
 
+# bin/entrypoint.sh creates DATA_DIR at start and gives it and /data to
+# the netwatch user, whatever is mounted there.
 ENV DATA_DIR=/data/reports
-RUN mkdir -p /data/reports && chown -R netwatch:netwatch /data
 VOLUME /data
 
 # The default public port; PORT changes it.