[LinuxDevil]

Fixes audit finding OPS-3 (Vercel competitor audit, 2026-10-19).

What was wrong

The generated image runs as node, but docker run -v lousho-data:/app/data -e LOUSHO_STORE=sqlite:/app/data/lousho.db mounted a root-owned fresh volume, so the server failed with unable to open database file.

What changed

• Dockerfile: RUN mkdir -p /app/data && chown node:node /app/data then VOLUME /app/data, both before USER node (Docker copies the image dir's ownership into a new named volume).
• docs/deployment.md: docker section shows the -v lousho-data:/app/data + LOUSHO_STORE=sqlite:/app/data/lousho.db example; llms-full.txt regenerated.
• No default LOUSHO_STORE is set (memory stays the default); the path is documented.

Tests

• docker.test.ts: Dockerfile has the mkdir+chown line before USER node and VOLUME /app/data (failed before the fix, passes after).
• docker.docker.test.ts (real daemon, run locally, 2/2 pass): build, run with a fresh named volume + sqlite store, /health 200, /chat 200, lousho.db exists on the volume.
• tsc, typecheck:tests, lint clean; docs:llms run. Full test:coverage: only packages/create-lousho-agent tests fail (Windows env, untouched by this change), which stops coverage-final.json being written, so npm run fallow could not run locally.

Changelog: Docker image now creates and chowns /app/data (declared a VOLUME) so a fresh named volume works with LOUSHO_STORE=sqlite:/app/data/...

🤖 Generated with Claude Code