Run as PUID:PGID with a configurable umask

The image now starts through docker-entrypoint.sh: as root it hands
/data and the backup folder to PUID:PGID (only files owned by someone
else, so restarts stay fast), applies UMASK, and runs Canon as that
user with su-exec. Started with --user, it runs Canon directly. The
image defaults to 1000:1000; the Compose file presets Unraid's 99:100.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -87,6 +87,8 @@ Keys entered in the UI are stored in the SQLite database on your server. Keys se
 | `CANON_HOST` | `0.0.0.0` | Interface to listen on. `0.0.0.0` makes it reachable from other devices on your network; `127.0.0.1` keeps it on this machine |
 | `CANON_PORT` | `4242` | Listen port |
 | `CANON_DATA_DIR` | `/data` (Docker), `./data` | Database + cached images |
+| `PUID` / `PGID` | `1000` (image), `99`/`100` (Compose) | Docker only: the user and group that own everything Canon writes. The Compose file defaults to Unraid's `nobody:users` |
+| `UMASK` | `022` | Docker only: permissions for new files (`002` makes them group-writable) |
 | `CANON_ADMIN_USERNAME` / `_PASSWORD` | | Create the owner account on first start |
 | `CANON_TMDB_API_KEY` | | |
 | `CANON_TVDB_API_KEY` / `CANON_TVDB_PIN` | | The PIN is only for user-supported keys |