Run backend as non-root user, add resource limits to all containers

- Dockerfile: create and switch to unprivileged appuser (HIGH fix)
- docker-compose: mem_limit + cpus on nginx (128m/0.25), backend (512m/0.5), db (512m/0.5)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/Dockerfile

@@ -7,4 +7,7 @@ RUN pip install --no-cache-dir -r requirements.txt
 
 COPY app/ ./app/
 
+RUN useradd -r -s /bin/false appuser
+USER appuser
+
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

docker-compose.yml

@@ -9,6 +9,8 @@ services:
     depends_on:
       - backend
     restart: unless-stopped
+    mem_limit: 128m
+    cpus: 0.25
 
   backend:
     build: ./backend
@@ -23,6 +25,8 @@ services:
       db:
         condition: service_healthy
     restart: unless-stopped
+    mem_limit: 512m
+    cpus: 0.5
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
       interval: 10s
@@ -45,6 +49,8 @@ services:
       timeout: 5s
       retries: 10
     restart: unless-stopped
+    mem_limit: 512m
+    cpus: 0.5
 
 volumes:
   mysql_data: