Harden the container: non-root, pinned images and dependencies, the key in a file (B-91, SEC-51, SEC-52, SEC-53; closes B-71, B-72)

- app runs as uid 1000; a one-shot data-permissions service chowns ./data to it
  and closes it to others (works on an older root-owned install with no host sudo);
  files are created 0600 (umask 077)
- python:3.12-slim and caddy:2-alpine pinned by digest; dependencies installed from
  requirements.lock with --require-hashes
- the Fernet key is XPRV_ENCRYPTION_KEY_FILE (./secrets/xprv_encryption.key, a compose
  secret), out of every environment variable and of a ./data backup
- setup.md no longer presents a second way to run the server (B-72)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,20 +1,39 @@
 services:
+  # B-91 (SEC-51): one-shot, as root, so the bind-mounted ./data belongs to the non-root
+  # user the app runs as (uid 1000) and is closed to everyone else — also the first time
+  # after an older root-owned install, with no sudo on the host.
+  data-permissions:
+    build: .
+    image: plm-lottery-app:local
+    user: "0:0"
+    entrypoint: ["/bin/sh", "-c", "chown -R 1000:1000 /data && chmod -R go-rwx /data"]
+    volumes:
+      - ./data:/data
+    restart: "no"
+
   app:
     build: .
+    image: plm-lottery-app:local
     restart: unless-stopped
     env_file: .env
     environment:
       - DATABASE_URL=sqlite+aiosqlite:////app/db_data/plm_lottery.db
       - MASTER_KEY_PATH=/app/key_data/master.xprv.enc
+      - XPRV_ENCRYPTION_KEY_FILE=/run/secrets/xprv_encryption_key
+    secrets:
+      - xprv_encryption_key
     volumes:
       - ./data/db:/app/db_data
       - ./data/keys:/app/key_data
       - ./data/logs:/app/logs
     expose:
       - "8123"
+    depends_on:
+      data-permissions:
+        condition: service_completed_successfully
 
   caddy:
-    image: caddy:2-alpine
+    image: caddy:2-alpine@sha256:d8542f48d34a9cf4e4c11a478865229840e87e4c96ea3f439101f31a5d35f75f
     restart: unless-stopped
     ports:
       - "80:80"
@@ -28,6 +47,12 @@ services:
     depends_on:
       - app
 
+# The Fernet key that protects the master key lives in its own file, outside ./data (a backup of
+# the data does not carry both) and in no environment variable (SEC-53).
+secrets:
+  xprv_encryption_key:
+    file: ./secrets/xprv_encryption.key
+
 volumes:
   caddy_data:
   caddy_config: