fix(security): batch-2 hardening — XSS allowlist, event-scoping, deploy

Address the seven findings from the security & deployment review.

High:
- upload: make infer authoritative — reject files it can't identify
  (SVG/HTML/JS) and require the detected MIME to be on an ALLOWED_MEDIA
  allowlist; derive the stored MIME and on-disk extension from the
  detected type, ignoring client filename/Content-Type. Closes the
  stored-XSS vector via media served on-origin.
- deploy: rename docker-compose.override.yml -> docker-compose.dev.yml
  so the default `docker compose up -d` no longer publishes Postgres
  5432 to the host; the port map is now opt-in via -f. README updated.

Medium:
- upload: DefaultBodyLimit::disable() -> max(576 MiB) as an HTTP-level
  OOM backstop; handler still enforces precise per-class size limits.
- docker: run backend and frontend as non-root users.

Low:
- social/upload: event-scope toggle_like, list_comments, add_comment,
  delete_comment, edit_upload, delete_upload via find_by_id_and_event /
  soft_delete_in_event — cross-event IDs now resolve to 404.
- Caddy: site-wide HSTS / nosniff / X-Frame-Options / Referrer-Policy,
  plus Content-Disposition: attachment on /media/originals/*.
- .env.example: replace default Postgres password with a CHANGE_ME hint.

Out of scope: localStorage JWT (root cause fixed; httpOnly cookies are a
larger change tracked separately).

Verified: cargo build (no new warnings), cargo test (3 passed),
caddy validate, docker compose config (no 5432 published by default).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/Dockerfile

@@ -20,8 +20,16 @@ FROM alpine:3.21
 
 RUN apk add --no-cache ca-certificates ffmpeg
 
+# Run as a non-root user. Pre-create and chown the media mount path so the fresh
+# named volume inherits the non-root ownership (Docker seeds an empty named volume
+# from the image directory, preserving its uid/gid) and uploads can be written.
+RUN addgroup -S app && adduser -S app -G app
+
 WORKDIR /app
 COPY --from=builder /app/target/release/eventsnap-backend ./
 
+RUN mkdir -p /media && chown -R app:app /app /media
+USER app
+
 EXPOSE 3000
 CMD ["./eventsnap-backend"]