fix(docker): align exposed port with server.port and run as non-root

[trinhvandat]

Context (P0 — real defect)

server.port=8081 but the Dockerfile has EXPOSE 8080, and docker-compose has no port mapping/healthcheck for the app. Container consumers targeting 8080 get nothing. Container also runs as root.

Scope

• Align port (pick one: revert app to 8080 or EXPOSE/map 8081 consistently across Dockerfile, compose, README, Swagger URLs in CLAUDE.md)
• Create a non-root user in the runtime stage and USER it
• Add app service to docker-compose with healthcheck (depends on Actuator issue) or document standalone run

Acceptance criteria

• docker build + docker run serves the API on the documented port
• Container process runs as non-root (verify with docker exec whoami)
• Docs updated (README/CLAUDE.md port references)