feat: TMDB year fallback + PUID/PGID support

- tmdb.py: store release_date year in cache, expose as tmdb_year
- main.py + app.js: use tmdb_year when subtitle has no year
- Dockerfile: add gosu + abc user for PUID/PGID runtime privilege drop
- entrypoint.sh: new entrypoint handling PUID/PGID ownership of /app/data

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

entrypoint.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+PUID=${PUID:-0}
+PGID=${PGID:-0}
+
+if [ "$PUID" != "0" ] || [ "$PGID" != "0" ]; then
+    groupmod -o -g "$PGID" abc 2>/dev/null || true
+    usermod  -o -u "$PUID" abc 2>/dev/null || true
+    mkdir -p /app/data
+    chown -R "$PUID:$PGID" /app/data 2>/dev/null || true
+    exec gosu abc "$@"
+else
+    exec "$@"
+fi