Harden production workflows and agent admission

web/Dockerfile

@@ -20,5 +20,9 @@ COPY --from=builder /app/.next ./.next
 COPY --from=builder /app/public ./public
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/package.json ./package.json
+# PH-015: run as the prebuilt non-root `node` user shipped by the base image.
+RUN chown -R node:node /app
+USER node
 EXPOSE 3000
+STOPSIGNAL SIGTERM
 CMD ["npm", "run", "start"]