README: name everything that runs as root in the container

The security-features bullet said only the entrypoint script runs as
root. With no USER in the image, the health check and docker exec also
run as root; the bullet now names all three.

Model: opus-5-5

README.md

@@ -3032,9 +3032,11 @@ check, see [The login endpoint](#the-login-endpoint).
 - Prometheus metrics behind basic auth
 - Static assets embedded in binary (no filesystem access needed at
   runtime)
-- The app runs as a non-root user (UID 1000) in the container; only
+- The app runs as the non-root `webhooker` user (UID 1000) in the
-  the `ENTRYPOINT` script that sets the data directory's owner runs as
+  container. The image sets no `USER`, so these run as root: the
-  root, before the app starts
+  `ENTRYPOINT` script, which sets the data directory's owner and mode
+  before the app starts; the image's health check; and `docker exec`,
+  unless given `--user`
 - GORM soft deletes on every entity that carries `BaseModel`, which is
   all of them but `Setting` (data preserved for audit)
 
@@ -3246,3 +3248,5 @@ MIT
 ## Author
 
 [@sneak](https://sneak.berlin)
+
+