Run the container as a non-root user

Add a static UID/GID 911 user (matching the socket-proxy/adguard-cidre
convention) and drop to it before running main.py. No PUID/PGID env var
or entrypoint chown logic needed here, unlike adguard-cidre — this
container has no volume mount and writes nothing to disk.

Dockerfile

@@ -20,4 +20,8 @@ CMD ["pytest", "-v"]
 
 FROM base
 
+RUN addgroup -g 911 nvbot && adduser -D -u 911 -G nvbot nvbot
+
+USER nvbot
+
 CMD ["python", "main.py"]