docker: fail-closed rebuild, ffmpeg checksum, smaller runtime

- Replace the mtime-touch stub-rebuild hack with cargo clean -p (a
  future-dated host file could silently ship the stub binary)
- Optional FFMPEG_SHA256 build arg verified before extraction
- Drop the redundant libssl3/libcrypto copies and the root
  supplementary group; strip the release binary; add a webhook-mode
  healthcheck to the compose example

docker-entrypoint.sh

@@ -16,7 +16,6 @@ then
    else
       usermod -u ${USER_ID} -o user > /dev/null 2>&1 || true
    fi
-   usermod -a -G root user > /dev/null 2>&1 || true
    # Bind-mounted volumes may not support chown; a failure here must not kill
    # the container either.
    chown -R `id -u user`:`id -u user` /app > /dev/null 2>&1 || true