Container runs as root, no HEALTHCHECK; compose uses :latest + hardcoded Grafana password

Severity: medium.

### Summary

Deployment hardening gaps in `bin/node/docker/`.

- **Dockerfile** (`Dockerfile:18-47`): final stage has no `USER` (runs as root) and no `HEALTHCHECK` (`grpc_health_probe` not bundled).
- **docker-compose.yml**: no `restart:` on any service (a node crash leaves the stack down); images pinned to `:latest` (`otel/opentelemetry-collector-contrib`, `grafana/grafana`, `grafana/tempo`, `prom/prometheus`); `GF_SECURITY_ADMIN_PASSWORD=admin` hardcoded; sets `OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf`, which the node ignores (`logging.rs` always uses `.with_tonic()` gRPC — it only works because the endpoint is the gRPC port). No Grafana dashboards/datasources are provisioned.
- **Makefile** `docker-run-node`: mounts `-v node-db:/db` but never passes `--database-url`, so it runs `:memory:` and the volume is dead weight (adjacent to #112).

### Recommendation

Add a non-root `USER` and a HEALTHCHECK (bundle `grpc_health_probe`); add `restart: unless-stopped`; pin image tags; env-parameterize the Grafana password; remove the misleading protocol var; provision a starter dashboard; pass `--database-url /db/node.db` in the Makefile target.

Related: #112.

---
Part of #114.

Examine the Dockerfile in bin/node/docker/ and the docker-compose.yml. Understand how the node service is built and run, including the health check mechanism (grpc_health_probe). Review the Makefile target 'docker-run-node' to see how the database URL is set. The work involves modifying Docker configurations, environment variables, and possibly adding provisioning for Grafana. Success means the container runs non-root, has a health check, uses pinned image tags, and the database volume is utilized.

Written by the indexing model from the issue text.