Add Docker security hardening with resource limits and capability restrictions

Apply security best practices to goclaw service: drop all capabilities, enable no-new-privileges, set read-only root filesystem with tmpfs for /tmp, limit PIDs to 200, and cap memory at 1G with 2 CPU cores.

docker-compose.yml

@@ -23,6 +23,19 @@ services:
       - GOCLAW_CONFIG=/app/data/config.json
     volumes:
       - goclaw-data:/app/data
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=256m
+    pids_limit: 200
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+          cpus: '2.0'
     restart: unless-stopped
 
 volumes: