harden(docker): non-root, dedicated healthcheck, opcache split, graceful shutdown

Coolify-doc-driven production hardening of the deploy stack:
- run the whole stack as non-root www-data; nginx on 8080 (non-privileged),
  pid in /tmp, user directive dropped (Coolify routes to any port)
- docker/healthcheck.sh: hit real /health route via PHP (not just port probe)
- split OPcache config into docker/php/opcache.ini
- graceful shutdown: supervisord stopsignal/stopwaitsecs + worker stop_grace_period
- APCu intentionally not added (Symfony cache uses redis)
- DEPLOY.md: 8080 port, non-root, resource-limit guidance

Verified on linux/amd64: non-root uid=82, /health 200, migrations run,
worker process healthcheck OK.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/php/php.ini

@@ -6,16 +6,6 @@ max_execution_time = 60
 expose_php = Off
 date.timezone = Asia/Tehran
 
-; OPcache (production)
-opcache.enable = 1
-opcache.enable_cli = 0
-opcache.memory_consumption = 256
-opcache.max_accelerated_files = 20000
-opcache.validate_timestamps = 0
-opcache.interned_strings_buffer = 16
-opcache.preload = /app/config/preload.php
-opcache.preload_user = www-data
-
 ; Realpath cache (perf)
 realpath_cache_size = 4096k
 realpath_cache_ttl = 600