Run backend as non-root user, add resource limits to all containers

- Dockerfile: create and switch to unprivileged appuser (HIGH fix)
- docker-compose: mem_limit + cpus on nginx (128m/0.25), backend (512m/0.5), db (512m/0.5)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/Dockerfile

@@ -7,4 +7,7 @@ RUN pip install --no-cache-dir -r requirements.txt
 
 COPY app/ ./app/
 
+RUN useradd -r -s /bin/false appuser
+USER appuser
+
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]