fix: non-root user + writable data dir for HF Spaces

Dockerfile

@@ -1,22 +1,21 @@
-# ---- build the web frontend ----
 FROM node:20-alpine AS webbuild
-WORKDIR /build
+WORKDIR /app/web
 COPY web/package.json ./
 RUN npm install
-COPY web/ ./
+COPY web ./
 RUN npm run build
 
-# ---- server runtime ----
 FROM node:20-alpine
-WORKDIR /app/server
-# build tools as a fallback if better-sqlite3 has no prebuilt binary
 RUN apk add --no-cache python3 make g++
+WORKDIR /app/server
 COPY server/package.json ./
 RUN npm install --omit=dev
-COPY server/ ./
-COPY --from=webbuild /build/dist /app/web/dist
-
-ENV NODE_ENV=production
-ENV PORT=8080
+COPY server ./
+COPY --from=webbuild /app/web/dist /app/web/dist
+# HF Spaces runs the container as a non-root user (UID 1000):
+# pre-create the data dir and hand the tree over so SQLite can write there.
+RUN mkdir -p /app/server/data && chown -R 1000:1000 /app/server
+ENV NODE_ENV=production PORT=8080
 EXPOSE 8080
+USER 1000
 CMD ["node", "src/index.js"]