fix: deployment hardening — non-root containers and health checks (#10)

- Gateway, Trips, Fitness Dockerfiles: run as non-root (appuser)
- Added HEALTHCHECK to gateway, trips, fitness
- Used --chown=appuser on COPY for correct file permissions
- Created data dirs with proper ownership before USER switch
- Trips Dockerfile no longer copies whole context (only server.py)

Partial fix for #10 — Node services (inventory, budget, frontend) not yet hardened.

services/fitness/Dockerfile.backend

@@ -1,7 +1,11 @@
 FROM python:3.12-slim
 WORKDIR /app
-RUN pip install bcrypt
-COPY server.py .
+RUN pip install --no-cache-dir bcrypt
+RUN adduser --disabled-password --no-create-home appuser
+RUN mkdir -p /app/data/images && chown -R appuser /app/data
+COPY --chown=appuser server.py .
 EXPOSE 8095
 ENV PYTHONUNBUFFERED=1
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD python3 -c "import urllib.request; urllib.request.urlopen('http://localhost:8095/api/health', timeout=3)" || exit 1
+USER appuser
 CMD ["python3", "server.py"]