fix(deployment): run Caddy non-root under all users, add process supervision, fix healthcheck

- docker-entrypoint.sh: always start both Caddy and Python instead of exiting
  early for non-root containers; drop Caddy's privileges via gosu (never runs
  as root); supervise both processes with `wait -n` and tear down the
  container if either one dies
- Caddyfile: add `admin off`; enforce MAX_UPLOAD_SIZE via `request_body
  max_size` on /api/* instead of relying on an unused env var
- docker-compose.yml: use explicit MAX_UPLOAD_SIZE=30MB unit
- Dockerfile: merge COPY+chown into a single `COPY --chown` layer for
  src/; fix HEALTHCHECK Python one-liner (literal \n was causing a
  SyntaxError on every check, so the container never reported healthy)

deployment/Dockerfile

@@ -112,12 +112,12 @@ RUN groupadd -r webssh && useradd -r -g webssh webssh
 
 WORKDIR /app/src
 
-# Copy application and static files
-COPY src/ /app/src/
+# Copy application and static files (owned by webssh in one layer, no separate chown pass)
+COPY --chown=webssh:webssh src/ /app/src/
 COPY deployment/docker-entrypoint.sh /usr/local/bin/
 
 # Create .ssh directory for host keys
-RUN mkdir -p /app/src/.ssh && chown -R webssh:webssh /app/src
+RUN mkdir -p /app/src/.ssh && chown webssh:webssh /app/src/.ssh
 
 # Copy entrypoint
 RUN chmod +x /usr/local/bin/docker-entrypoint.sh
@@ -137,7 +137,7 @@ EXPOSE 8080 8081 8082 8083
 
 # Health check via Caddy (serving root) using Python (no curl required)
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-    CMD python -c "import sys,urllib.request as u;\ntry:\n r=u.urlopen('http://127.0.0.1:8080/', timeout=5);\n code=getattr(r,'status',None) or r.getcode();\n sys.exit(0 if code==200 else 1)\nexcept Exception:\n sys.exit(1)"
+    CMD python -c "import sys, urllib.request; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8080/', timeout=5).getcode() == 200 else 1)"
 
 # Use shell form to see entrypoint errors
 ENTRYPOINT /usr/local/bin/docker-entrypoint.sh