deploy(docker): utente non root e versioni base pinnate (#38)

Punto 1: useradd -u 10001 app, chown /app (+ /app/uploads sul server),
USER app in tutti e tre i Dockerfile. Stesso UID sul server e sul worker
di visione, che condividono il volume uploads in sola lettura (punto 13).

Punto 2: python:3.11.16-slim (server, client), python:3.13.15-slim
(vision), ghcr.io/astral-sh/uv:0.10.9 (versione locale di `uv --version`).
Dockerfile.frontend: TailwindCSS ora si compila in uno stage separato
dall'immagine ufficiale node:20.20.2-bookworm-slim, non più con
`curl | bash` su nodesource nell'immagine finale.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile.vision

@@ -1,4 +1,4 @@
-FROM python:3.13-slim
+FROM python:3.13.15-slim
 
 # opencv-python (pulled in transitively by vs-core/vs-task/vs-measure/vs-pm2d)
 # needs libGL and glib at runtime even though it is never imported by name here.
@@ -6,7 +6,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         libgl1 libglib2.0-0 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /usr/local/bin/uv
+
+# Non-root user the app runs as at runtime. Same UID as the server's Dockerfile
+# so both containers agree on ownership of the shared uploads volume (point 13).
+RUN useradd -u 10001 app
 
 WORKDIR /app
 COPY pyproject.toml uv.lock ./
@@ -34,6 +38,9 @@ RUN test -n "$VISION_ENGINE_VERSION" || { \
     }
 ENV VISION_ENGINE_VERSION=${VISION_ENGINE_VERSION}
 
+RUN chown -R app:app /app
+USER app
+
 EXPOSE 8100
 
 # Two workers, not four: each holds the vision stack in memory.