fix(docker): use writable directories for supervisord pid and redis data

- supervisord: write pidfile to /tmp (tmpfs) instead of read-only /app
- redis: set working dir to /var/lib/redis (tmpfs) for RDB snapshots

Fixes "could not write pidfile" and "Failed opening temp RDB file" errors
in read-only root filesystem deployment (docker-compose.yml security hardening).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: TobiasWallura-xitaso

deploy/docker/entrypoint.sh

@@ -34,4 +34,4 @@ else
 fi
 export GUNICORN_BIND
 
-exec supervisord -c supervisord.conf
+exec supervisord -c supervisord.conf --pidfile /tmp/supervisord.pid

deploy/docker/supervisord.conf

@@ -6,7 +6,7 @@ logfile_maxbytes=0
 [program:redis]
 ; Loopback-only and password-protected. REDIS_PASSWORD is exported by
 ; entrypoint.sh from the mounted secret; the app must supply it to connect.
-command=/usr/bin/redis-server --loglevel notice --bind 127.0.0.1 ::1 --requirepass "%(ENV_REDIS_PASSWORD)s"
+command=/usr/bin/redis-server --loglevel notice --bind 127.0.0.1 ::1 --requirepass "%(ENV_REDIS_PASSWORD)s" --dir /var/lib/redis
 user=appuser                    ; Run redis as our non-root user
 autorestart=true
 priority=10