build: harden Docker images for least privilege

[tim48-robot]

fixes Medium: Docker COPY . . (possible sensitive file inclusion).
fixes Medium: container running as root.
Addresses “copied resources should not be writable by non‑root.

[github-actions]

⚠️ PR Description Issues Detected

• Missing issue reference (e.g., 'Fixes Graphics #123')

Please update the PR description to address these issues.

[Copilot]

Pull request overview

This PR hardens Docker images for security by implementing least privilege principles across three Dockerfiles. It addresses security scanner findings related to sensitive file inclusion and running containers as root.

Key changes:

• Creates and switches to non-root users in all containers to prevent running as root
• Replaces COPY . . with explicit selective file copying to avoid including sensitive files
• Changes npm install to npm ci for more secure, deterministic builds
• Adds cleanup of apt cache to reduce image size and attack surface

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
firebase-emulator/Dockerfile	Adds non-root 'firebase' user, explicit file copying, apt cache cleanup, and creates firebase-debug.log with proper ownership
Dockerfile-playwright	Creates non-root 'app' user, replaces wildcards with explicit file copying in both build and production stages, sets up Playwright cache with proper permissions
Dockerfile	Implements non-root 'app' user in production stage, removes .env file from build stage, uses explicit file copying instead of wildcards, switches from npm install to npm ci

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tim48-robot]

wait before merged letme check the hotspot problem

[tim48-robot]

should be ready to merge, and somehow sonarcloud always does false positive :/

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud