Ensure Docker container runs as non root user

[marcofranssen]

Related to kagent-dev/kagent#1874

[djannot]

The non-root goal is good, but this breaks docker build as written: USER 14000 is placed before npm install/npm run build.

Since /app is root-owned and UID 14000 has no home dir, npm can't write its cache and fails with EACCES on /.npm.

The npx puppeteer ... || true would fail the same way, just silently.

It also assumes mounted data volumes are writable by UID 14000, which breaks existing deployments. The privilege drop needs to happen after the build, with a real user + home + chown of /app.

[marcofranssen]

Rebased to resolve conflict. Also addressed feedback.

I have split the build from runtime stage to reduce the deps and attach surface. Indeed deployments would need to filemount directories using gid 14000 with this change to maintain file access etc.