fix(docker): imagem final sem privilégios (nginx-unprivileged, porta 8080)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -14,7 +14,8 @@ Everything notable in PSS is recorded here. The format follows
   (`git.lucasrguerra.dev.br`). The deployment pulls the image from its registry.
 - The `Dockerfile` is multi-stage: it builds Vite from source inside the image instead
   of unpacking a `dist.tar.gz` committed to the repository (removed, along with the
-  `build:release` script).
+  `build:release` script). The final stage is `nginx-unprivileged`: the container runs
+  as the `nginx` user and listens on port 8080 instead of 80 (Trivy DS-0002).
 - New CI on Gitea runners (`.gitea/workflows`): types, 282 tests, Trivy on the repository
   and on the image, and an image smoke test. The image is built once per content hash and
   reused by the release, so a merge or a tag on an already validated commit rebuilds nothing.