Fix projects/ volume ownership on container start

The named Docker volume mounted at /app/projects is created by Docker
as root before the container starts, so the image's build-time chown
never applies to it. A root-owned volume made the app (running as the
non-root forge user) unable to write new game folders in production.

Add an entrypoint that chowns /app/projects to forge at each startup,
then drops privileges before exec'ing gunicorn.

Dockerfile

@@ -8,8 +8,14 @@ RUN pip install --no-cache-dir -r requirements-prod.txt
 COPY . .
 
 RUN useradd --create-home forge && chown -R forge:forge /app
-USER forge
+
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 
 EXPOSE 5050
 
+# Démarre en root (nécessaire pour corriger la propriété du volume monté sur
+# /app/projects, voir docker-entrypoint.sh) — le script abandonne ensuite les
+# privilèges root avant de lancer gunicorn.
+ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["gunicorn", "--bind", "0.0.0.0:5050", "--workers", "2", "app:app"]