feat: TMDB year fallback + PUID/PGID support

- tmdb.py: store release_date year in cache, expose as tmdb_year
- main.py + app.js: use tmdb_year when subtitle has no year
- Dockerfile: add gosu + abc user for PUID/PGID runtime privilege drop
- entrypoint.sh: new entrypoint handling PUID/PGID ownership of /app/data

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

main.py

@@ -32,7 +32,7 @@ async def _run_auto_dl_check() -> int:
         for c in concerts:
             if not dm.already_enqueued(c["url"]):
                 m = re.search(r"\b(20\d{2})\b", c.get("subtitle", ""))
-                year = int(m.group(1)) if m else None
+                year = int(m.group(1)) if m else c.get("tmdb_year")
                 await dm.enqueue(c["url"], c["title"], c.get("subtitle", ""), year, cat)
                 total += 1
     return total