Remediate RC6 container scan findings

deploy/unraid/Dockerfile.all-in-one

@@ -13,6 +13,8 @@ ARG GEOINTEL_TORCH_INDEX_URL=https://download.pytorch.org/whl/cpu
 ARG GEOINTEL_TORCH_VERSION=2.13.0
 ARG GEOINTEL_TORCHVISION_VERSION=0.28.0
 ARG GEOINTEL_ULTRALYTICS_VERSION=8.4.99
+ARG GEOINTEL_SETUPTOOLS_VERSION=83.0.0
+ARG GEOINTEL_WHEEL_VERSION=0.47.0
 
 ENV GEOINTEL_ENV=production \
     GEOINTEL_API_PREFIX=/api/v1 \
@@ -48,6 +50,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
+COPY deploy/unraid/gosu-setpriv /usr/local/bin/gosu
 COPY backend/pyproject.toml /app/
 COPY backend/requirements-runtime.lock /app/
 COPY backend/app/__init__.py /app/app/__init__.py
@@ -63,6 +66,9 @@ RUN printf '# GeoIntel backend package metadata\n' > /app/README.md \
          && pip install --no-cache-dir \
            "ultralytics==$GEOINTEL_ULTRALYTICS_VERSION"; \
        fi \
+    && pip install --no-cache-dir \
+      "setuptools==$GEOINTEL_SETUPTOOLS_VERSION" \
+      "wheel==$GEOINTEL_WHEEL_VERSION" \
     && pip check
 
 COPY backend/ /app/
@@ -139,7 +145,7 @@ COPY deploy/unraid/nginx-all-in-one.conf /etc/nginx/conf.d/default.conf
 COPY deploy/unraid/all-in-one-start.sh /usr/local/bin/geointel-all-in-one-start
 COPY --from=frontend-build /frontend/dist/ /usr/share/nginx/html/
 
-RUN chmod +x /usr/local/bin/geointel-all-in-one-start \
+RUN chmod +x /usr/local/bin/geointel-all-in-one-start /usr/local/bin/gosu \
     && chmod +x \
       /app/scripts/train_operator_yolo_detector.sh \
       /app/scripts/verify_real_data_detection_qa_workflow.sh \

deploy/unraid/gosu-setpriv

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -lt 2 ]; then
+  echo "usage: gosu user command [args...]" >&2
+  exit 64
+fi
+
+target_user="$1"
+shift
+exec setpriv \
+  --reuid="$target_user" \
+  --regid="$target_user" \
+  --init-groups \
+  "$@"