Hardening: Switch to non-root user in Docker

[RinZ27]

Dropped root privileges in the production Docker image. Running the app process as a dedicated memos user instead of root to minimize the potential impact if the process is compromised. Standard hardening practice.

Also updated the directory creation and ownership to ensure the memos user has proper access to its data volumes.

[Copilot]

Pull request overview

This PR implements Docker security hardening by dropping root privileges in the production container image. The application now runs as a dedicated non-root memos user, following container security best practices to minimize the attack surface if the process is compromised.

Key Changes:

• Created a dedicated memos system user and group in the Alpine-based Docker image
• Set proper ownership of application and data directories for the memos user
• Switched the container runtime context to the non-root user

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[RinZ27]

Good catch. Updated the Dockerfile to use explicit UID/GID 10001 for better predictability with volume mounts.