fix(docker): mount Flashpoint read-write by default

The shipped compose mounted the Flashpoint directory read-only, so every write
the app makes to it failed: recording downloaded state in flashpoint.sqlite,
saving downloaded game data under Data/Games, and metadata sync. The Downloaded
page marked nothing and the reconciler warned on every boot.

Drop :ro from both compose files and the README's snippet, and correct the docs
that described the mount as read-only.

README.md

@@ -83,7 +83,7 @@ services:
     ports:
       - "${WEB_PORT:-80}:3100"
     volumes:
-      - ${FLASHPOINT_HOST_PATH:?FLASHPOINT_HOST_PATH is required}:/data/flashpoint:ro
+      - ${FLASHPOINT_HOST_PATH:?FLASHPOINT_HOST_PATH is required}:/data/flashpoint
       - ${DATA_PATH:-./data}:/app/data
       - ${LOGS_PATH:-./logs}:/app/logs
     environment:
@@ -106,6 +106,11 @@ services:
       start_period: 40s
 ```
 
+The Flashpoint directory is mounted read-write: the app records which games are
+downloaded in `flashpoint.sqlite` and saves downloaded game data under
+`Data/Games`. Mount it read-only and browsing still works, but downloads and the
+Downloaded page do not.
+
 ### 3. Create `.env`
 
 Two values are required. This is a complete, working `.env`:

docker-compose.dev.yml

@@ -26,7 +26,9 @@ services:
       # Serves both the UI and the API (/api, /game-proxy, /game-zip) on one port
       - "${WEB_PORT:-80}:3100"
     volumes:
-      - ${FLASHPOINT_HOST_PATH:?FLASHPOINT_HOST_PATH is required}:/data/flashpoint:ro
+      # Read-write: the app records downloaded state in flashpoint.sqlite and
+      # writes downloaded game data under Data/Games.
+      - ${FLASHPOINT_HOST_PATH:?FLASHPOINT_HOST_PATH is required}:/data/flashpoint
       - backend-db:/app/data
       - ${LOGS_PATH:-./logs}:/app/logs
     environment:

docker-compose.yml

@@ -25,7 +25,9 @@ services:
       # Serves both the UI and the API (/api, /game-proxy, /game-zip) on one port
       - "${WEB_PORT:-80}:3100"
     volumes:
-      - ${FLASHPOINT_HOST_PATH:?FLASHPOINT_HOST_PATH is required}:/data/flashpoint:ro
+      # Read-write: the app records downloaded state in flashpoint.sqlite and
+      # writes downloaded game data under Data/Games.
+      - ${FLASHPOINT_HOST_PATH:?FLASHPOINT_HOST_PATH is required}:/data/flashpoint
       - ${DATA_PATH:-./data}:/app/data
       - ${LOGS_PATH:-./logs}:/app/logs
     environment:

docs/09-deployment/docker-deployment.md

@@ -50,11 +50,11 @@ docker-compose up -d --build
 
 ## Volume Configuration
 
-**Flashpoint Data (read-only):**
+**Flashpoint Data (read-write):**
 
 ```yaml
 volumes:
-  - ${FLASHPOINT_HOST_PATH}:/data/flashpoint:ro
+  - ${FLASHPOINT_HOST_PATH}:/data/flashpoint
 ```
 
 **User Database (persistent):**
@@ -228,7 +228,7 @@ docker-compose exec backend curl http://localhost:3100/api/health
 1. Use named volumes for persistent data
 2. Set resource limits to prevent resource exhaustion
 3. Enable health checks for automatic recovery
-4. Use read-only mounts for Flashpoint data
+4. Restrict the Flashpoint mount to the single directory the app needs
 5. Run as non-root user
 6. Keep images updated with security patches
 7. Monitor logs regularly

docs/09-deployment/security-considerations.md

@@ -211,7 +211,7 @@ db.prepare(`SELECT * FROM game WHERE title LIKE '%${query}%'`).all();
 
 **Database permissions:**
 
-- Flashpoint database: read-only
+- Flashpoint database: read-write (downloaded state and metadata sync write to it)
 - User database: read/write by app only
 - No DROP/ALTER permissions
 - Foreign key constraints enabled