fix(docker): run API container as root for Docker socket access

The API container needs to run docker compose commands via the
mounted Docker socket. Running as non-root user doesn't work well
with socket permissions across container boundaries.

- Remove USER appuser from Dockerfile (API service only)
- Remove group_add from docker-compose (no longer needed)
- Add security note about considering Docker-in-Docker or rootless

This fixes:
permission denied while trying to connect to the docker API at unix:///var/run/docker.sock

docker-compose.traefik.yml

@@ -102,8 +102,6 @@ services:
       - avatar_uploads:/app/uploads
       - /var/run/docker.sock:/var/run/docker.sock
       - cloudflared_config:/etc/cloudflared
-    group_add:
-      - ${DOCKER_GID:-999}
     depends_on:
       postgres:
         condition: service_healthy