- Multi-stage build: frontend, static Go binary with embedded assets, distroless nonroot runtime (~35 MB) with a built-in healthcheck - Explain how to fix data directory permission errors on bind mounts