Add a dedicated `eirescope` user (UID 1000) and chown /app to it so
the image no longer runs as root.
Drop flask and sqlalchemy from requirements.txt — neither is imported
anywhere; the server uses stdlib http.server and raw sqlite3. Add
jinja2 explicitly (it was previously a transitive of Flask) and pin
upper bounds on every dep so builds are at least somewhat reproducible.
