Run as PUID:PGID with a configurable umask

The image now starts through docker-entrypoint.sh: as root it hands
/data and the backup folder to PUID:PGID (only files owned by someone
else, so restarts stay fast), applies UMASK, and runs Canon as that
user with su-exec. Started with --user, it runs Canon directly. The
image defaults to 1000:1000; the Compose file presets Unraid's 99:100.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -5,6 +5,7 @@
 # Build tools may add their own copy of the Dockerfile (Arcane writes
 # .arcane.external.Dockerfile), which has to reach the builder.
 !*Dockerfile*
+!docker-entrypoint.sh
 !go.mod
 !go.sum
 !cmd/