fix: use login shell when dropping privileges in manifest entrypoint

The generated entrypoint used a brittle  invocation that could
spawn a non-interactive bash and exit immediately, causing containers to
stop with exit code 0 right after startup.

- Switch to  so the
  container user gets a login shell and stdin/tty are preserved
- Update the unit test assertion for the new drop-privileges command

Quality gates:
- pytest tests/unit: 219 passed
- ruff: clean on changed files
- mypy: clean on changed files

apps/api/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: apps/api
 
 ## role
-FastAPI backend API that manages projects, git repositories, and development tools through Docker containers with PostgreSQL persistence.
+Backend API service that provides a FastAPI-based management layer for projects, git repositories, and containerized development tools with database-backed state.
 ## parent
 index: apps/.pi-map.index.md
 map: apps/.pi-map.md