Create writable /app/data in image for push subscription persistence

app/Dockerfile

@@ -7,6 +7,9 @@ RUN npm ci --omit=dev
 
 COPY . .
 
+# Ensure runtime data directory exists and is writable when running as non-root.
+RUN mkdir -p /app/data && chown -R node:node /app
+
 ENV PORT=3000
 ENV NODE_ENV=production