harden(docker): non-root USER i Dockerfile.admin

infrastructure/docker/Dockerfile.admin

@@ -12,6 +12,10 @@ RUN pnpm install --frozen-lockfile --filter @app/admin...
 RUN pnpm --filter @app/admin build
 
 FROM nginx:alpine AS runtime
+RUN addgroup -S app && adduser -S app -G app
+WORKDIR /app
 COPY --from=builder /build/apps/admin/dist /usr/share/nginx/html
 COPY infrastructure/docker/nginx-admin.conf /etc/nginx/conf.d/default.conf
-EXPOSE 80
+RUN chown -R app:app /usr/share/nginx/html /var/cache/nginx /var/log/nginx /etc/nginx/conf.d
+USER app
+EXPOSE 8080

infrastructure/docker/nginx-admin.conf

@@ -1,5 +1,5 @@
 server {
-  listen 80;
+  listen 8080;
   server_name _;
   root /usr/share/nginx/html;
   index index.html;