feat: add persistent container server setup

[flexdinesh]

• config owns separate remote settings; cmd/diffx-server composes defaults, explicit read-only JSON, env vars and flags without accessing personal CLI config.
• Docker uses overridable env defaults; Compose adds a persistent SQLite volume, non-root execution and a read-only root filesystem for server development. Mise tasks and docs cover binary/container iteration.
• reviewstore refuses older schemas without resetting data in both modes. Durable storage now requires an explicit fresh-database choice instead of automatic data loss.
• Validation: mise run check:push passed, including full checks and Go race tests. Binary/container smoke checks verified authenticated ingestion, persisted reviews and credentials after recreation, exclusive ownership and SIGTERM shutdown; generated assets clean.
• Remaining limits: one SQLite owner, no automatic migrations. No UI changes.