Deploy reno scheduling engine (FastAPI + Streamlit)

Dockerfile

@@ -1,18 +1,24 @@
 # Hugging Face Space (Docker SDK). Runs the FastAPI backend + Streamlit UI.
+# Follows HF's recommended non-root-user pattern so HOME is writable
+# (Streamlit config/cache + the SQLite file).
 FROM python:3.12-slim
 
-WORKDIR /app
+RUN useradd -m -u 1000 user
+USER user
+ENV HOME=/home/user \
+    PATH=/home/user/.local/bin:$PATH \
+    SCHED_DB_PATH=/home/user/app/scheduling.db \
+    PYTHONUNBUFFERED=1
 
-COPY requirements-space.txt .
-RUN pip install --no-cache-dir -r requirements-space.txt
+WORKDIR /home/user/app
 
-COPY app ./app
-COPY migrations ./migrations
-COPY scripts ./scripts
-COPY streamlit_app.py start.sh ./
+COPY --chown=user requirements-space.txt .
+RUN pip install --no-cache-dir --user -r requirements-space.txt
 
-ENV SCHED_DB_PATH=/tmp/scheduling.db \
-    PYTHONUNBUFFERED=1
+COPY --chown=user app ./app
+COPY --chown=user migrations ./migrations
+COPY --chown=user scripts ./scripts
+COPY --chown=user streamlit_app.py start.sh ./
 
 EXPOSE 7860
 CMD ["bash", "start.sh"]