Fix Docker backend startup with root-owned bind mounts

[aarshe22]

Problem

On Linux, following the Docker Compose setup from a root-owned checkout causes the backend to restart continuously. Startup first fails with PermissionError: [Errno 13] Permission denied: 'WareHouse', then with the same error for logs after the first folder is manually repaired. Workflow storage also needs a writable data/ directory.

The image assigns /app to appuser, but Compose's .:/app bind mount hides that image ownership. The non-root backend therefore cannot create its runtime storage in the host checkout.

Change

Add a one-shot backend-init Compose service which prepares WareHouse/, logs/, and data/ before the backend starts. Only this initializer runs as root; the backend retains the image's non-root user. Existing storage content is retained and assigned to appuser, without changing source-file ownership. The initializer lives outside /app so the checkout mount cannot hide it.

Symlinked storage roots are rejected, and nested symlinks are not followed. Custom storage locations still require explicit permissions. Document the setup and Docker-native workflow sync command in both READMEs.

Validation

• Built the runtime Docker image on ARM64 Docker Desktop.
• Ran sh tools/test_docker_permissions.sh chatdev-permissions-test: reproduced the original permission failure using a root-owned Linux Docker volume; ran initialization twice; verified existing data preservation, unchanged source ownership, non-root writes to all three directories, successful backend HTTP startup, and workflow database read/write.
• Passed three standard-library unit tests covering repeated initialization, preservation, and symlink handling.
• Passed docker compose config --quiet, shell syntax validation, and git diff --check.

The regression uses a root-owned Docker volume to reproduce Linux ownership semantics independently of Docker Desktop host-file sharing. It does not exercise model inference or the frontend. The original failure and manual recovery were also observed on an Ubuntu ARM64 host.