Ensure /app/data is writable for non-root backend (gosu entrypoint)

[DeepZone]

Motivation

• Prevent SQLite write failures (sqlite3.OperationalError: attempt to write a readonly database) caused by a root-owned routeforge_data:/app/data volume while keeping the backend runtime non-root.
• Normalize only /app/data ownership at container start to avoid expensive full-image chown and preserve existing hardening and runtime behavior.

Description

• Add backend/docker-entrypoint.sh which creates /app/data, chown -R routeforge:routeforge /app/data, and drops privileges via gosu before execing the provided command.
• Update backend/Dockerfile to install gosu, create the routeforge user, copy and make the entrypoint executable, keep /app/data creation in image build, set ENTRYPOINT to the new script, and keep the existing CMD (uvicorn ...).
• Document the behavior and troubleshooting guidance in docs/operations/security.md and docs/operations/logging.md explaining the SQLite volume location and the readonly-database error cause and fix.
• The change limits permission normalization to /app/data only and does not alter API behavior, business logic, or production Postgres compose usage.

Testing

• Backend unit tests were run with cd backend && pytest -q and passed: 77 passed (with warnings).
• Frontend production build was run with cd frontend && npm run build and completed successfully.
• A runtime/docker-compose verification (docker compose build/backend && docker compose up) could not be executed in this environment because docker is not available.

---

Codex Task