Keep the database in ./data and bind-mount it

SQLite writes three files — the database plus its -wal and -shm companions.
Putting them in one directory means a deployment mounts a single path and a
backup copies a single directory.

- FOODSTER_DB defaults to ./data/foodster.db, and openDB creates the parent
  directory on startup rather than failing on a fresh checkout
- compose bind-mounts ./data instead of using a named volume, so the file can
  be listed, copied and opened with any sqlite client without going through
  the container engine
- the image runs as UID 65534, which cannot write to a host directory owned
  by someone else, so compose now sets user: from FOODSTER_UID/FOODSTER_GID
- `make up` creates ./data first: left to the engine it appears root-owned
  and the app silently cannot write to it

PRD.md

@@ -342,13 +342,19 @@ on the server and run with Docker Compose.
   static binary; the runtime stage is `FROM scratch` holding only that
   binary, running as UID 65534.
 - **Compose**: a single service. No database container — SQLite lives at
-  `/data/foodster.db` on a named volume. `restart: unless-stopped`.
+  `/data/foodster.db`, bind-mounted from `./data` on the host rather than
+  kept in a named volume, so the file can be listed and copied without going
+  through the container engine. Backup is `cp -r data`. Because the image
+  runs as UID 65534, compose sets `user:` from `FOODSTER_UID`/`FOODSTER_GID`
+  to match whoever owns that directory. `restart: unless-stopped`.
 - **Configuration**, entirely through environment variables (see
   `.env.example`):
   - `FOODSTER_REPO` and `FOODSTER_TAG` — image coordinates.
   - `FOODSTER_PASSWORD` — the shared password. Required; the app refuses to
     start without it.
-  - `FOODSTER_DB` — database file path, default `/data/foodster.db`.
+  - `FOODSTER_DB` — database file path, default `./data/foodster.db`. The
+    directory is created on startup if missing.
+  - `FOODSTER_UID` / `FOODSTER_GID` — host owner of `./data`.
   - `TZ` — default `Europe/Helsinki`.
 - The registry hostname exists only in `.env`, which is gitignored, because
   §11 leaves open the possibility of publishing this repository.