Fix Docker startup failure: set writable home directory for app user

[Copilot]

Container crashes on startup because adduser --system defaults to home dir /nonexistent. HuggingFace Hub tries to cache the sentence-transformer model at $HOME/.cache/huggingface/, which fails with PermissionError.

• Set --home /home/app on adduser so the user gets a real, writable home directory

# Before
RUN addgroup --system app && adduser --system --ingroup app app

# After
RUN addgroup --system app && adduser --system --home /home/app --ingroup app app

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• huggingface.co
  • Triggering command: /home/REDACTED/.local/bin/pytest pytest -v (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

Fixes a container startup crash by ensuring the non-root app user has a real, writable home directory, which is required for HuggingFace Hub model caching.

Changes:

• Update adduser invocation to set the app user’s home directory to /home/app.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.