[P0] Dataprep Dockerfile runs all processes as root

Problem

The dataprep Dockerfile never creates a non-root user or switches away from root. The final container runs all Python processes (including network services and file I/O) as root, which violates the principle of least privilege.

Files

• dataprep/Dockerfile-dataprep_genie-ai — Entire file runs as root (no USER directive)
• dataprep/Dockerfile-dataprep_genie-ai:88 — EasyOCR models installed to /root/.EasyOCR/

Contrast

The http-service/Dockerfile-http-service_genie-ai correctly creates a non-root user and switches to it (lines 11-13, 25).

Impact

If an attacker exploits any vulnerability in the dataprep service (e.g., the path traversal above), they gain root access within the container, increasing the blast radius of the compromise.

Acceptance Criteria

• Create a non-root user in the dataprep Dockerfile
• Move EasyOCR model directory to a non-root location (e.g., /home/user/.EasyOCR/)
• Add USER directive before the CMD instruction
• Ensure all writable directories are owned by the non-root user
• Apply the same fix to the retriever and reranker Dockerfiles if they have the same issue