Enhancement: Docker container filesystem hardening — read_only, cap_drop, tmpfs

[mrveiss]

Problem

PR #1930 added no-new-privileges:true and resource limits, but standard Docker hardening measures are missing:

• No read_only: true filesystem restriction on any service
• No cap_drop: [ALL] with selective cap_add
• No tmpfs mounts for /tmp or /var/run

These are standard Docker production security practices that limit container escape surface area.

Discovered During

Code review of PR #1930 (Finding 6)

Fix

Add for stateless services (at minimum frontend, prometheus, grafana):
```yaml
read_only: true
tmpfs:

• /tmp
• /var/run
  cap_drop:
• ALL
  ```

For stateful services (redis, postgres, backend), add cap_drop: [ALL] with selective cap_add for required capabilities.

Impact

Severity: medium — Defense-in-depth hardening.

[mrveiss]

Merged in PR #2537. Added cap_drop/cap_add, read_only, tmpfs, and security_opt across all 6 docker-compose files (main, 3 playwright variants, secure-sandbox monitor, loki/grafana).