Non-root users cannot bind to privileged ports (<1024) without ambient
capabilities, which Docker does not set by default. Switch uvicorn,
healthcheck, and docker-compose port mapping from 80 to 8080. Also
combine the two RUN instructions for user/directory setup into one layer.
Addresses review feedback on #122.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>