Pin alpine base image and run as non-root user

[eswan18]

Summary

• Pin runtime base image from alpine:latest to alpine:3.21 for reproducible builds
• Add non-root appuser in the runtime stage using Alpine's adduser -D syntax
• Add USER appuser directive before CMD so the container runs as non-root
• Standardizes this Dockerfile with the fitness-api and fitness-dashboard services

Test plan

• Build the Docker image locally and verify it completes successfully
• Run the container and confirm the service starts and responds on port 8080
• Verify the process runs as appuser (e.g. docker exec <ctr> whoami)
• Deploy to staging and confirm K8s health probes pass

🤖 Generated with Claude Code