perf(docker): kill the cold-start chown bottleneck + warn about first-build time

[nbkdoesntknowcoding]

Fixes the two issues from the Mnema cold-start benchmark: the ~7-min chown build bottleneck and the silent-wait UX gap.

The bottleneck

A cold docker compose up -d --build took ~9:43; ~7 min was three recursive chown -R steps rewriting every inode over huge node_modules / Chromium trees (api 169.9s, workers 128.7s Chromium-layer export, web 123.6s).

Root cause: files were COPYed as root then chowned to node in a separate RUN layer. But the runtime never writes under /app (uploads to object storage; web sessions are sealed iron-session cookies, not Astro's filesystem session store), so the whole-tree chown was unnecessary.

Fix

• api / collab / web: COPY --chown=node:node the app code + build output; delete RUN chown -R node:node /app. Prod node_modules stays root-owned + world-readable (read-only at runtime).
• workers: delete chown -R node:node /app /ms-playwright — the browsers path is already world-readable/executable via the existing chmod -R a+rX, and Chromium's writable profile lives under HOME=/home/node. Stops rewriting the whole Chromium tree into a second layer.
• All four images still run as non-root node. Base images, versions, tsc/build config untouched.

Silent-wait UX

scripts/self-host-init.sh now warns the first build takes several minutes and looks idle while images build (not a hang), and points at docker compose logs -f.

Checklist

• One logical change; matches surrounding style.
• Signed off for the DCO.
• Core change — not enterprise-adjacent.