fix(docker): model downloads failed in containers (curl exit 23, glibc mismatch)

- pin builder and runtime to the same Debian release (trixie): the floating
  rust:1-slim builder drifted to a newer glibc than the bookworm runtime, so
  freshly built images crashed on start with 'GLIBC_2.39 not found'
- install curl in the runtime image — ready-.cmf imports download with it
- keep all gateway state under /app/data (CORTIQ_GATEWAY_HOME) and run as
  root so bind-mounted host folders on Docker Desktop are writable; pass
  --user 10001 to harden when not bind-mounting
- persist /app/data via a cortiq-data volume in docker-compose
- fail imports immediately with the path and reason when the models dir
  cannot be created, and annotate curl exit codes 23/22 with readable hints
- exclude local models/*.cmf from the docker build context

README.md

@@ -54,7 +54,8 @@ One OpenAI-compatible endpoint → automatic model selection from your pool
 ```bash
 # Docker (GitHub Container Registry)
 docker run -p 9000:9000 -e CORTIQ_ADMIN_TOKEN=secret \
-  -v "$PWD/config:/app/config" ghcr.io/infosave2007/cortiq-gateway:latest
+  -v "$PWD/config:/app/config" -v cortiq-data:/app/data \
+  ghcr.io/infosave2007/cortiq-gateway:latest
 # → admin console at http://localhost:9000/admin
 
 # from crates.io
@@ -67,7 +68,10 @@ cargo build --release   # ./target/release/cortiq-gateway
 ```
 
 The image ships a default config and runs out of the box; mount `/app/config` (with a
-`gateway.toml`) to use your own. Tags: `:latest`, `:X.Y.Z`, `:edge` (linux/amd64 + arm64).
+`gateway.toml`) to use your own. Downloaded models and stats live in `/app/data` — mount
+a volume there so they survive container recreates (a host folder works too, e.g.
+`-v "$PWD/models:/app/data/models"`). Tags: `:latest`, `:X.Y.Z`, `:edge`
+(linux/amd64 + arm64).
 
 **Docker Compose** — gateway + a local Ollama model in one command: