fix(docker): model downloads failed in containers (curl exit 23, glibc mismatch)

- pin builder and runtime to the same Debian release (trixie): the floating
  rust:1-slim builder drifted to a newer glibc than the bookworm runtime, so
  freshly built images crashed on start with 'GLIBC_2.39 not found'
- install curl in the runtime image — ready-.cmf imports download with it
- keep all gateway state under /app/data (CORTIQ_GATEWAY_HOME) and run as
  root so bind-mounted host folders on Docker Desktop are writable; pass
  --user 10001 to harden when not bind-mounting
- persist /app/data via a cortiq-data volume in docker-compose
- fail imports immediately with the path and reason when the models dir
  cannot be created, and annotate curl exit codes 23/22 with readable hints
- exclude local models/*.cmf from the docker build context

.dockerignore

@@ -1,4 +1,6 @@
 target
+models
+*.cmf
 .git
 .github
 docs