fix(docker): make browser temp dir mount-safe

Dockerfile

@@ -89,8 +89,9 @@ COPY target/release/picobot /usr/local/bin/picobot
 # Copy config template
 COPY resources/templates/config.example.json /app/config.json.example
 
-# Create required directories
-RUN mkdir -p /app/.picobot/workspace /app/.picobot/media /app/.picobot/tmp && \
+# Create persistent application directories. Browser temporary data stays in
+# /tmp so bind-mounting /app/.picobot cannot hide its temporary directory.
+RUN mkdir -p /app/.picobot/workspace /app/.picobot/media && \
     chown -R app:app /app
 
 USER app
@@ -98,7 +99,7 @@ ENV HOME=/app
 
 # Environment variables for Chromium in containers
 ENV CHROME_BIN=/usr/bin/chromium
-ENV TMPDIR=/app/.picobot/tmp
+ENV TMPDIR=/tmp
 
 ENTRYPOINT ["/usr/local/bin/picobot"]
 CMD ["gateway"]

docker-compose.test.yml

@@ -1,5 +1,8 @@
 services:
   picobot:
+    build:
+      context: .
+      dockerfile: Dockerfile
     image: picobot:1.2.0
     container_name: picobot-test
     restart: unless-stopped