stage18: docker hardening — non-root user, read-only FS, no-new-privileges, health-check fix, .dockerignore

docker-compose.yml

@@ -7,6 +7,8 @@ x-common: &common
   env_file:
     - .env
   restart: unless-stopped
+  security_opt:
+    - no-new-privileges:true
   deploy:
     resources:
       limits:
@@ -85,7 +87,7 @@ services:
     volumes:
       - nsct_data:/app/data
     healthcheck:
-      test: ["CMD-SHELL", "curl -f http://localhost:8080/health || exit 1"]
+      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8080/health')\" || exit 1"]
       interval: 30s
       timeout: 5s
       retries: 3