fix(runtime): chown /data to uid 1000 and write firebase creds safely; ensure /data dirs

Dockerfile

@@ -25,13 +25,17 @@ COPY . .
 
 # Create directories for uploads and results
 # Ensure writable data directory exists for Spaces
-RUN mkdir -p /data/uploads /data/results
+RUN mkdir -p /data/uploads /data/results && chown -R 1000:1000 /data
 
 # Handle Firebase credentials from environment variable (for Hugging Face Spaces secrets)
 # This allows the credentials to be passed as a secret and written to file at runtime
-RUN echo '#!/bin/bash' > /entrypoint.sh && \
+RUN echo '#!/bin/sh' > /entrypoint.sh && \
+    echo 'set -e' >> /entrypoint.sh && \
     echo 'if [ -n "$FIREBASE_CREDENTIALS" ]; then' >> /entrypoint.sh && \
-    echo '  echo "$FIREBASE_CREDENTIALS" > /data/firebase-adminsdk.json' >> /entrypoint.sh && \
+    echo '  mkdir -p /data' >> /entrypoint.sh && \
+    echo '  touch /data/firebase-adminsdk.json' >> /entrypoint.sh && \
+    echo '  chmod 600 /data/firebase-adminsdk.json' >> /entrypoint.sh && \
+    echo '  printf "%s" "$FIREBASE_CREDENTIALS" > /data/firebase-adminsdk.json' >> /entrypoint.sh && \
     echo 'fi' >> /entrypoint.sh && \
     echo 'exec "$@"' >> /entrypoint.sh && \
     chmod +x /entrypoint.sh