security: harden Dockerfile and add .dockerignore

[sylvainkalache]

Summary

• Add non-root user (appuser) to Dockerfile so the container process doesn't run as root, reducing blast radius if compromised
• Create .dockerignore to exclude .git, .venv, tests, coverage files, CI configs, and other dev artifacts from the Docker image

Test plan

• Verify all unit tests pass
• Build Docker image and confirm it starts correctly as non-root user
• Verify .git and other excluded files are not in the built image

[greptile-apps]

Greptile Overview

Greptile Summary

This PR hardens the Docker configuration by running the container as a non-root user and excluding development files from the image.

Key changes:

• Creates appuser (UID 1000) and switches to it before running the application
• Adds .dockerignore to exclude .git, .venv, tests, cache files, and CI configs

Critical issue:

• The application writes swagger.json to /app (server.py:3564) but appuser won't have write permissions to this directory since ownership wasn't transferred after file copying

Confidence Score: 2/5

• This PR will cause runtime failures when the application attempts to write the swagger file
• The non-root user implementation will prevent the application from writing required files to /app, causing the application to fail when fetching swagger specs
• Dockerfile requires fixing ownership of /app directory for appuser

Important Files Changed

Filename	Overview
Dockerfile	Added non-root user for security, but missing write permissions for /app directory where application writes swagger.json
.dockerignore	Comprehensive exclusions for dev artifacts, tests, cache files, and CI configs to reduce image size

[greptile-apps]

_{2 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

appuser won't have write permissions to /app but the application writes swagger.json there (server.py:3564). Either change ownership of /app to appuser after copying files, or create a writable cache directory.

Suggested change

	RUN useradd -m -u 1000 appuser
	RUN useradd -m -u 1000 appuser && chown -R appuser:appuser /app

Prompt To Fix With AI

This is a comment left during a code review.
Path: Dockerfile
Line: 22:22

Comment:
`appuser` won't have write permissions to `/app` but the application writes `swagger.json` there (server.py:3564). Either change ownership of `/app` to `appuser` after copying files, or create a writable cache directory.

```suggestion
RUN useradd -m -u 1000 appuser && chown -R appuser:appuser /app
```

How can I resolve this? If you propose a fix, please make it concise.