chore: bootstrap development environment

docker/entrypoint.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+set -eu
+
+# A named volume keeps its original ownership when reused between services.
+# Normalize it at startup, then run the application as the unprivileged node user.
+mkdir -p /app/data
+chown -R node:node /app/data
+
+exec setpriv --reuid=node --regid=node --init-groups "$@"