Add non-root user to all Docker images

[Copilot]

All Docker images ran as root by default. This adds a dedicated appuser (UID/GID 1001) to both Dockerfile and Dockerfile.cuda, with the IDs overridable at build time via ARG.

Changes

• Both Dockerfiles (final stage)
  • ARG UID=1001 / ARG GID=1001 — overridable via --build-arg
  • groupadd / useradd creates appuser with the specified IDs
  • chown -R appuser:appuser /app /venv — transfers ownership of the app and venv
  • USER ${UID}:${GID} — drops to non-root for runtime; numeric IDs ensure enforcement in Kubernetes without name resolution

Usage

# Default 1001:1001
docker build -t fastapi-vss .

# Custom UID/GID
docker build --build-arg UID=2000 --build-arg GID=2000 -t fastapi-vss .