fix(deployment): run Caddy non-root under all users, add process supervision, fix healthcheck

- docker-entrypoint.sh: always start both Caddy and Python instead of exiting
  early for non-root containers; drop Caddy's privileges via gosu (never runs
  as root); supervise both processes with `wait -n` and tear down the
  container if either one dies
- Caddyfile: add `admin off`; enforce MAX_UPLOAD_SIZE via `request_body
  max_size` on /api/* instead of relying on an unused env var
- docker-compose.yml: use explicit MAX_UPLOAD_SIZE=30MB unit
- Dockerfile: merge COPY+chown into a single `COPY --chown` layer for
  src/; fix HEALTHCHECK Python one-liner (literal \n was causing a
  SyntaxError on every check, so the container never reported healthy)

deployment/Caddyfile

@@ -1,6 +1,7 @@
 {
-    # Disable automatic HTTPS for local development
+    # No TLS is terminated here, so disable HTTPS redirects/certs and the admin API
     auto_https off
+    admin off
 }
 
 :8080 {
@@ -13,6 +14,10 @@
 
     # HTTP API endpoints (preserve /api/* path)
     handle /api/* {
+        # Reject oversized uploads before they reach the backend
+        request_body {
+            max_size {$MAX_UPLOAD_SIZE:100MB}
+        }
         reverse_proxy 127.0.0.1:8082
     }