fix(docker): restore capabilities for privilege drop

docker-compose.yml

@@ -8,6 +8,11 @@ x-common-config: &common-config
     - ~/.nanobot:/home/nanobot/.nanobot
   cap_drop:
     - ALL
+  # Entrypoint uses these to fix bind-mount ownership and drop to the nanobot user.
+  cap_add:
+    - CHOWN
+    - SETGID
+    - SETUID
 
 services:
   nanobot-gateway: