fix(docker): model downloads failed in containers (curl exit 23, glibc mismatch)

- pin builder and runtime to the same Debian release (trixie): the floating
  rust:1-slim builder drifted to a newer glibc than the bookworm runtime, so
  freshly built images crashed on start with 'GLIBC_2.39 not found'
- install curl in the runtime image — ready-.cmf imports download with it
- keep all gateway state under /app/data (CORTIQ_GATEWAY_HOME) and run as
  root so bind-mounted host folders on Docker Desktop are writable; pass
  --user 10001 to harden when not bind-mounting
- persist /app/data via a cortiq-data volume in docker-compose
- fail imports immediately with the path and reason when the models dir
  cannot be created, and annotate curl exit codes 23/22 with readable hints
- exclude local models/*.cmf from the docker build context

src/import.rs

@@ -406,7 +406,13 @@ async fn download_cmf_repo(
                 }
                 Ok(status) => {
                     cleanup_output(&output_abs);
-                    store.push_line(&id, format!("✗ download failed: exit code {:?}", status.code()));
+                    // curl 23 = write error: almost always a non-writable models dir
+                    let hint = match status.code() {
+                        Some(23) => " (write error — is the models dir writable?)",
+                        Some(22) => " (HTTP error — repo/file not found or auth required)",
+                        _ => "",
+                    };
+                    store.push_line(&id, format!("✗ download failed: exit code {:?}{hint}", status.code()));
                     store.finish(&id, false);
                 }
                 Err(e) => {
@@ -471,7 +477,13 @@ pub fn start_import(store: Arc<JobStore>, cfg: &CmfCfg, p: ImportParams) -> Resu
             }
         }
     }
-    let _ = std::fs::create_dir_all(&cfg.models_dir);
+    std::fs::create_dir_all(&cfg.models_dir).map_err(|e| {
+        format!(
+            "cannot create models dir {}: {e} — check that the gateway has write \
+             access (in Docker, mount a writable volume at the models path)",
+            cfg.models_dir
+        )
+    })?;
     let base = if p.name.trim().is_empty() {
         sanitize(p.repo.rsplit('/').next().unwrap_or(&p.repo))
     } else {