Run containers as the host user instead of root

Everything the containers wrote into the bind mounts (surreal_data, notebook_data)
was owned by root, so the host user could not delete or back up his own podcast
data — prune_podcast_data.py and update_stack.sh had to detour through
`docker compose exec` for every rm and tar.

That was not a requirement, just the default: the open_notebook image declares no
USER, and the compose file even overrode surrealdb's own non-root user (65532)
with `user: root`, under the comment "Required for bind mounts on Linux" — which
is not true.

Both services now run as user: "1000:1000". Two things this needs:

- HOME=/tmp for open_notebook. Without it HOME resolves to "/" for a non-root uid,
  uv cannot create /.cache/uv, and api + worker exit 2 at startup. Verified by
  running the image as uid 1000 both ways.
- The data directories must be owned by that uid. Existing data was adopted with a
  throwaway root container (chown -R), no sudo needed.

Both scripts drop the container detour and operate on the host directly, which is
simpler and now honest. smoke_test.sh gained two checks so a silent regression to
root cannot go unnoticed: the container's uid must match the host user, and no
foreign-owned files may exist under the data directories.

Verified: containers run as uid 1000, new files land as dschlueter and are
deletable without sudo, SurrealDB writes as 1000, a source can be created,
embedded and deleted through the API, and the full smoke test is green.

Note this deviates from what the image expects (it assumes root), so it is exactly
the kind of assumption an update can break — hence the smoke-test checks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -17,7 +17,10 @@ services:
     restart: always
     pull_policy: missing
     command: start --log info --user ${SURREAL_USER:-root} --pass ${SURREAL_PASSWORD:-root} rocksdb:/mydata/mydatabase.db
-    user: root  # Required for bind mounts on Linux
+    # Als Host-User laufen, nicht als root: sonst gehoeren alle Dateien in
+    # ./surreal_data root und der Host-User kann sie weder loeschen noch zurueckspielen.
+    # (Die Verzeichnisse gehoeren 1000:1000 — siehe Kommentar bei open_notebook.)
+    user: "1000:1000"
     environment:
       - SURREAL_EXPERIMENTAL_GRAPHQL=true
     ports:
@@ -31,12 +34,22 @@ services:
     image: lfnovo/open_notebook:v1-latest@sha256:c8112fbd4b8fee7f2a20d3bdbea24e7d72267acfc990b803fd0ff4de30899b57
     restart: always
     pull_policy: missing
+    # Als Host-User (dschlueter, 1000:1000) laufen statt als root. Das Image definiert
+    # keinen USER, liefe also als root — und alles, was es nach ./notebook_data schreibt,
+    # gehoerte dann root: der Host-User koennte Podcast-Daten weder loeschen noch sichern.
+    # Voraussetzung: surreal_data/ und notebook_data/ gehoeren 1000:1000. Bei einem
+    # Neuaufbau anlegen mit:  mkdir -p surreal_data notebook_data
+    user: "1000:1000"
     depends_on:
       - surrealdb
     ports:
       - "127.0.0.1:8502:8502"
       - "127.0.0.1:5055:5055"
     environment:
+      # Ohne HOME zeigt es bei Nicht-Root auf "/", und uv scheitert beim Anlegen
+      # seines Caches (/.cache/uv, Permission denied) -> api/worker starten nicht.
+      # /tmp ist im Container schreibbar; der Cache ist ohnehin fluechtig.
+      - HOME=/tmp
       - OPEN_NOTEBOOK_ENCRYPTION_KEY=${OPEN_NOTEBOOK_ENCRYPTION_KEY}
       - SURREAL_URL=ws://surrealdb:8000/rpc
       - SURREAL_USER=${SURREAL_USER:-root}