Inject encrypted runtime credentials from Space secret

Dockerfile

@@ -10,9 +10,10 @@ WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY package.json tsconfig.json config.example.yaml ./
 COPY src ./src
-RUN mkdir -p /data && chown bun:bun /data
+COPY entrypoint.sh /entrypoint.sh
+RUN mkdir -p /data /home/bun/.zcode-proxy && chown -R bun:bun /data /home/bun/.zcode-proxy /entrypoint.sh
 ENV ZCODE_PROXY_PORT=8080
 ENV ZCODE_PROXY_CONFIG=/data/config.yaml
 EXPOSE 8080
 USER bun
-CMD ["bun", "run", "src/index.ts", "serve"]
+ENTRYPOINT ["/entrypoint.sh"]