Docker hardening: non-root user, distroless base, trimpath/static build

**Severity:** Medium
**Files:** `Dockerfile`, `docker-compose.yml`

Current final stage runs as root from `alpine:3.19` with `WORKDIR /root/`. Builder uses `go build -v web/mudzipserver.go` (file-mode build, no flags).

### Remediation
```dockerfile
FROM golang:1.23 AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download && go mod verify
COPY . .
RUN CGO_ENABLED=0 GOFLAGS=-trimpath go build -ldflags="-s -w" -o /out/mudzipserver ./web

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=builder /out/mudzipserver /mudzipserver
USER nonroot:nonroot
EXPOSE 8085
ENTRYPOINT [\"/mudzipserver\"]
```

In `docker-compose.yml`, add `read_only: true`, `cap_drop: [ALL]`, `security_opt: [no-new-privileges:true]`, and `user: \"65532:65532\"`.