fix: make workdir writable for config/cookie generation at runtime

Configure for Hugging Face Space (Docker): port 7860, non-root user, secret-driven config via run.py