fix(dockerfile): add explicit numeric USER 101 for Kubernetes runAsNonRoot

nginxinc/nginx-unprivileged sets USER nginx internally, but the kubelet
cannot resolve non-numeric string usernames against OCI image config at
container-create time. With runAsNonRoot: true, K3s kubelet reports:
  "container has runAsNonRoot and image will run as root"

Fix: explicitly add USER 101 after the COPY steps. UID 101 is the numeric
UID that nginx-unprivileged's nginx user already runs as — this instruction
just makes it visible in the final OCI image config layer so the kubelet
can verify non-root without username resolution.

Companion infra PR cartsnitch/infra#77 adds runAsUser: 101 as immediate
unblock while this Dockerfile change propagates through CI.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Dockerfile

@@ -9,13 +9,17 @@ RUN npm ci
 COPY . .
 RUN npm run build
 
-# Stage 2: Production
-FROM nginx:stable-alpine AS prod
+# Stage 2: Production — uses nginxinc/nginx-unprivileged which runs as non-root (UID 101)
+FROM nginxinc/nginx-unprivileged:stable-alpine AS prod
 
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 
-EXPOSE 80
+# Explicitly declare numeric UID 101 (nginx-unprivileged's nginx user) so
+# Kubernetes can verify runAsNonRoot without resolving string usernames.
+USER 101
+
+EXPOSE 8080
 
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-  CMD wget -qO- http://localhost/health || exit 1
+  CMD wget -qO- http://localhost:8080/health || exit 1

nginx.conf

@@ -1,5 +1,5 @@
 server {
-    listen 80;
+    listen 8080;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;