fix: pin the Python patch version and run the app as a non-root user

Two follow-ups to the review of the base image change.

1. Pin the patch version: `python:3.14-slim` is a floating tag, so a rebuild
   could silently pick up a different base image. It is now
   `python:3.14.10-slim`, so a rebuild is reproducible.

2. Run the app as an unprivileged user. The app only reads its own source
   and talks to Mongo over the network — it writes no files — so it does not
   need to be root. A `beer` system user is created and the image ends with
   `USER beer`.

flask.Dockerfile

@@ -8,6 +8,12 @@ ADD src /beer_data/src
 # (``import brewing``), so that directory is the working directory.
 WORKDIR /beer_data/src/flask
 
+# Run as an unprivileged user.  The app only needs to read its own source
+# and talk to Mongo over the network — it writes no files — so it does not
+# need to be root.
+RUN useradd --system --create-home --home-dir /home/beer --shell /usr/sbin/nologin beer \
+    && chown -R beer:beer /beer_data
+
 # The app is served by waitress, not the Flask development server.
 # FLASK_DEBUG stays OFF: the old entrypoint ran the Werkzeug debugger in
 # production, which exposes an interactive console on any unhandled error.
@@ -21,6 +27,8 @@ ENV PORT=5000
 # session-signing key.
 # ENV SECRET_KEY=...
 
+USER beer
+
 EXPOSE 5000
 
 ENTRYPOINT ["python", "-m", "waitress", "--listen=0.0.0.0:5000", "--call", "beer_data:create_app"]