fix(scripts): prevent entrypoint restart loop when MEMOS_UID=0

The root-drop guard only checked `id -u = 0`, so when the target user was
also root (MEMOS_UID=0, common under rootless Docker with userns-remap)
su-exec re-execed back into root, re-entered the block, and looped forever
without ever reaching the memos binary — the container hung with no logs.

Add a MEMOS_ENTRYPOINT_SWITCHED marker (preserved across the su-exec
re-exec) so the privilege drop runs at most once, and log the resolved
UID:GID on startup so this path is never silent again.

Closes #6061

scripts/entrypoint.sh

@@ -1,18 +1,25 @@
 #!/usr/bin/env sh
 
-# Fix ownership of data directory for users upgrading from older versions
-# where files were created as root
+# Fix ownership of the data directory (e.g. for users upgrading from older
+# versions where files were created as root) and drop to a non-root user.
 MEMOS_UID=${MEMOS_UID:-10001}
 MEMOS_GID=${MEMOS_GID:-10001}
 DATA_DIR="/var/opt/memos"
 
-if [ "$(id -u)" = "0" ]; then
-    # Running as root, fix permissions and drop to nonroot
+# MEMOS_ENTRYPOINT_SWITCHED marks that the privilege drop below has already run.
+# su-exec preserves the environment, so the marker survives the re-exec. Without
+# it, a target of UID 0 (e.g. MEMOS_UID=0, common under rootless Docker) would
+# stay root after su-exec, re-enter this block, and loop forever.
+if [ "$(id -u)" = "0" ] && [ -z "${MEMOS_ENTRYPOINT_SWITCHED:-}" ]; then
+    # Started as root: fix permissions, then re-exec as the target user.
     if [ -d "$DATA_DIR" ]; then
         chown -R "$MEMOS_UID:$MEMOS_GID" "$DATA_DIR" 2>/dev/null || true
     fi
+    echo "memos: starting as UID:GID ${MEMOS_UID}:${MEMOS_GID}"
+    export MEMOS_ENTRYPOINT_SWITCHED=1
     exec su-exec "$MEMOS_UID:$MEMOS_GID" "$0" "$@"
 fi
+unset MEMOS_ENTRYPOINT_SWITCHED
 
 file_env() {
    var="$1"