Add code resolver, sync conflict handling, and user isolation

Introduce a CodeResolverService to classify user login codes, complete with detailed resolution logic and usability checks. Extend the sync system to handle conflicts via last-write-wins arbitration, with detailed conflict tracking for review. Update file permissions and runtime isolation in Docker to enhance security.

Dockerfile

@@ -24,9 +24,12 @@ WORKDIR /app
 # Prisma needs OpenSSL at runtime.
 RUN apt-get update && apt-get install -y --no-install-recommends openssl \
   && rm -rf /var/lib/apt/lists/*
-COPY --from=api-build /src/node_modules ./node_modules
-COPY --from=api-build /src/dist ./dist
-COPY --from=api-build /src/prisma ./prisma
+RUN groupadd -g 1001 kc-user && useradd -u 1001 -g kc-user -m -d /home/kc-user kc-user
+COPY --from=api-build --chown=kc-user:kc-user /src/node_modules ./node_modules
+COPY --from=api-build --chown=kc-user:kc-user /src/dist ./dist
+COPY --from=api-build --chown=kc-user:kc-user /src/prisma ./prisma
+RUN chown -R kc-user:kc-user /app
+USER kc-user
 # Web client bundle is bind-mounted at runtime, not baked into the image;
 # app.module reads WEB_CLIENT_DIR. See docker-compose.yml.
 EXPOSE 3000