conf(compose & chart): update conf to be rootless

[thomasboni]

No description provided.

[cursor]

PR Summary

Medium Risk
Updates runtime user/port assumptions for the backend/worker and enforces non-root security contexts, which can break deployments if clusters/ingress/volumes expect privileged ports or root ownership.

Overview
Bumps the Helm chart/app version to 1.3.6 and updates image tags (frontend v2.34.8, backend/worker v2.40.1).

Switches Helm defaults for front, backend, and worker to run rootless by default by setting container + pod securityContext (runAsNonRoot with explicit UID/GID and fsGroup).

Updates local deployment examples (Docker Compose + Podman) to use a non-privileged backend port (JOBS_LISTEN_PORT=3000), adjusts exposed ports/Traefik routing to target 3000, and changes worker startup to invoke the distroless backend binary via args (no shell wrapper).

^{Reviewed by Cursor Bugbot for commit e3d9e71. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9184147. Configure here.}