Fix media permissions inside app container

docker/anouma-entrypoint.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -eu
+
+# /app/media is a persistent host bind mount in production. Its host owner
+# can differ from the unprivileged application user inside the image, so fix
+# the mount ownership before dropping privileges for the actual app process.
+if [ -d /app/media ]; then
+  chown -R nextjs:nodejs /app/media
+  chmod 775 /app/media
+fi
+
+exec su-exec nextjs "$@"