fix: resolve Docker volume permission denied on startup

Root cause: Docker named volumes are created as root, but the container
ran as the unprivileged 'oxicloud' user (UID 1001). Services like
thumbnail_service, image_transcode, and dedup_service call
create_dir_all under /app/storage during initialization, which fails
with 'Permission denied (os error 13)'.

Changes:
- Add entrypoint.sh that runs as root to chown /app/storage, then
  drops privileges via su-exec before executing the application
- Update Dockerfile to install su-exec, copy entrypoint, and use
  ENTRYPOINT instead of USER+CMD
- Downgrade id_mapping_service initial write failure from ERROR to WARN
  (empty in-memory map is perfectly valid, will persist on next save)
- Improve panic message in main.rs to hint at Docker permission issue

Fixes #<issue>

entrypoint.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+set -e
+
+# Fix ownership of mounted volumes.
+# When Docker creates named volumes they are owned by root, but the
+# application runs as the unprivileged "oxicloud" user (UID 1001).
+# This script runs as root, fixes permissions, then drops privileges.
+
+STORAGE_DIR="/app/storage"
+STATIC_DIR="/app/static"
+
+# Ensure the storage directory exists and is writable by oxicloud
+if [ -d "$STORAGE_DIR" ]; then
+    chown -R oxicloud:oxicloud "$STORAGE_DIR"
+fi
+
+# Ensure static directory is readable
+if [ -d "$STATIC_DIR" ]; then
+    chown -R oxicloud:oxicloud "$STATIC_DIR"
+fi
+
+# Drop privileges and exec the main binary (or whatever was passed as CMD)
+exec su-exec oxicloud "$@"