fix(docker): address security and reproducibility issues

Fixes from maintainer review:

.dockerignore:
- Add .env* files to prevent secret leakage (CRITICAL)
- Add tests/, docs/, IDE files to reduce build context
- Add organized comments for maintainability

Dockerfile:
- Pin bun version (ARG BUN_VERSION=1.2.2) for reproducible builds
- Add build artifact validation step
- Add npm cache clean to reduce image size
- Add section comments for readability

docker-compose.yml:
- Add grok_home volume for grok-cli persistence
- Add start_period to healthcheck for slow starts
- Add resource limits (1G RAM, 2 CPUs) with reservations
- Add documentation comments

entrypoint.sh:
- Improve chown error handling with warning message
- Add usage help when no command provided

README.md:
- Add Resource Limits section with examples
- Add Graceful Shutdown documentation
- Add Troubleshooting section (permissions, ports, restart loops)
- Add Security Notes section
- Update persistence docs to include grok-cli

Co-authored-by: opastorello <nicolas@pastorello-lab.com.br>

docker/entrypoint.sh

@@ -5,19 +5,30 @@ ccs_home_dir="${CCS_HOME_DIR:-/home/node/.ccs}"
 
 mkdir -p "$ccs_home_dir"
 
+# Fix volume permissions if running as root
 if [ "$(id -u)" = "0" ]; then
-  chown -R node:node "$ccs_home_dir" || true
+  if ! chown -R node:node "$ccs_home_dir" 2>/dev/null; then
+    echo "[!] Warning: Could not change ownership of $ccs_home_dir (read-only volume?)" >&2
+  fi
 fi
 
+# Show usage if no command provided
 if [ "$#" -eq 0 ]; then
   echo "[X] No command provided" >&2
+  echo "" >&2
+  echo "Usage: docker run ccs-dashboard <command>" >&2
+  echo "" >&2
+  echo "Examples:" >&2
+  echo "  docker run ccs-dashboard node dist/ccs.js config" >&2
+  echo "  docker run ccs-dashboard ccs --help" >&2
+  echo "" >&2
   exit 1
 fi
 
+# Drop privileges from root to node user
 if [ "$(id -u)" = "0" ]; then
   cmd="$(printf '%q ' "$@")"
   exec su -s /bin/bash node -c "exec ${cmd}"
 fi
 
 exec "$@"
-