Run as PUID:PGID with a configurable umask

The image now starts through docker-entrypoint.sh: as root it hands
/data and the backup folder to PUID:PGID (only files owned by someone
else, so restarts stay fast), applies UMASK, and runs Canon as that
user with su-exec. Started with --user, it runs Canon directly. The
image defaults to 1000:1000; the Compose file presets Unraid's 99:100.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -31,6 +31,11 @@ CANON_IGDB_CLIENT_SECRET=
 # CANON_DATA_PATH=/srv/canon
 # Where backups are written. Default: the canon_canon-backups volume.
 # CANON_BACKUP_PATH=/mnt/nas/canon-backups
+# Owner of the files Canon writes (database, images, backups). The Compose
+# file defaults to Unraid's 99:100 (nobody:users).
+# PUID=99
+# PGID=100
+# UMASK=022
 # Host address and port to publish on.
 # CANON_BIND=0.0.0.0
 # CANON_PUBLISH_PORT=4242