Drop JAVA_TOOL_OPTIONS and --system from the image

JAVA_TOOL_OPTIONS made the JVM print "Picked up ..." on every invocation, and
the entrypoint already sets file.encoding through JAVA_OPTS. useradd --system
warned because the uid is above SYS_UID_MAX; the explicit uid is what matters.

Verified end to end on Docker 29.4: image builds, the full pipeline runs
inside the container against a read-only collection mount, the frontend and
MCP answer on the published port, and the database survives a restart in the
named volume. The read-only mount was confirmed to actually reject writes,
and the container runs as uid 10001, not root.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Dockerfile

@@ -20,14 +20,15 @@ WORKDIR /app
 
 # obrazy płyt montowane z zewnątrz, tylko do odczytu; katalog danych to wolumen
 VOLUME ["/data"]
-ENV CATALOG_DATA=/data \
-    JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF-8"
+# file.encoding ustawia entrypoint przez JAVA_OPTS; JAVA_TOOL_OPTIONS robiłoby
+# to samo, ale JVM wypisuje wtedy "Picked up..." przy każdym uruchomieniu
+ENV CATALOG_DATA=/data
 
 COPY --from=build /src/build/install/rex-catalog /app
 COPY --from=build /src/core-version /app/core-version
 COPY docker-entrypoint.sh /app/entrypoint.sh
 RUN chmod +x /app/entrypoint.sh \
- && useradd --system --uid 10001 --create-home katalog \
+ && useradd --uid 10001 --create-home katalog \
  && mkdir -p /data /media \
  && chown katalog:katalog /data
 USER katalog