Build HF app as UID 1000 so runtime user owns .venv

Dockerfile

@@ -16,6 +16,14 @@ RUN apt-get update && apt-get install -y \
     && rm -rf /var/lib/apt/lists/* \
     && git lfs install
 
+# HF Spaces runs the container as a non-root user (UID 1000) at runtime. Create
+# that user and build everything under it so it owns the .venv and can execute
+# /app/esp-research/.venv/bin/python3.
+RUN useradd -m -u 1000 user
+RUN mkdir -p /app && chown -R user:user /app
+USER user
+ENV HOME=/home/user
+
 RUN --mount=type=secret,id=GH_TOKEN,mode=0444,required=true \
     git -c "http.https://github.com/.extraheader=Authorization: Basic $(printf 'x-access-token:%s' "$(cat /run/secrets/GH_TOKEN)" | base64 | tr -d '\n')" \
         clone --single-branch --depth 1 https://github.com/earthspecies/esp-research.git /app/esp-research