Docker hardening (non-root, healthcheck, .dockerignore, log caps) + UI table/typography polish

docker-compose.yml

@@ -3,6 +3,16 @@ services:
     build: .
     container_name: card-grader
     restart: unless-stopped
+    # Proper PID-1 signal handling — a clean, immediate stop on
+    # `docker compose down` instead of the 10s SIGKILL timeout.
+    init: true
+    # Without a cap, an always-on container's json log grows unbounded on
+    # the array — this is a server that never reboots, so it would.
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
     # Bound to all interfaces (not 127.0.0.1) because Nginx Proxy Manager
     # runs in its own container on a separate macvlan IP (192.168.86.2),
     # not in this host's network namespace — it has to reach this over the