Container sets its data directory's owner and mode itself (closes #340)

The image now starts as root through deploy/docker-entrypoint.sh,
which creates DATA_DIR if it is missing, gives the directory and
anything in it owned by another user to webhooker, sets the directory
to 0750, and runs the command as webhooker with su-exec. An empty
root-owned bind mount, or data left by another uid, now works with no
step on the host. Started with --user, the script only runs the
command.

The README drops every instruction to create or chown the host
directory; the upaas volume bullet names only the path.

Model: opus-5-5

README.md

@@ -3032,11 +3032,9 @@ check, see [The login endpoint](#the-login-endpoint).
 - Prometheus metrics behind basic auth
 - Static assets embedded in binary (no filesystem access needed at
   runtime)
-- The app runs as the non-root `webhooker` user (UID 1000) in the
+- The app runs as a non-root user (UID 1000) in the container; only
-  container. The image sets no `USER`, so these run as root: the
+  the `ENTRYPOINT` script that sets the data directory's owner runs as
-  `ENTRYPOINT` script, which sets the data directory's owner and mode
+  root, before the app starts
-  before the app starts; the image's health check; and `docker exec`,
-  unless given `--user`
 - GORM soft deletes on every entity that carries `BaseModel`, which is
   all of them but `Setting` (data preserved for audit)
 
@@ -3248,5 +3246,3 @@ MIT
 ## Author
 
 [@sneak](https://sneak.berlin)
-
-