Docker hardening + first-run fixes

drizzle/0013_add_storage_public_base_url.sql

@@ -0,0 +1,2 @@
+-- Migration: Add storage_public_base_url column to users table
+ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "storage_public_base_url" text;

drizzle/meta/_journal.json

@@ -92,6 +92,13 @@
       "when": 1769586699065,
       "tag": "0012_quick_mockingbird",
       "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "7",
+      "when": 1769638500000,
+      "tag": "0013_add_storage_public_base_url",
+      "breakpoints": true
     }
   ]
 }