fix(deploy): writable data_dir in container + fatal-on-mkdir

The Dockerfile created the minstrel user but never set a WORKDIR or
pre-created a writable data dir. With the default DataDir of "./data"
and CWD of "/", every MkdirAll attempt failed with "permission denied"
under the non-root user, and the boot code only logged a Warn before
continuing. Result: every artist-art enrichment failed at
"mkdir artist-art: mkdir data: permission denied"; the operator saw
"0 successes" with no signal as to why.

Three changes:
- Dockerfile: WORKDIR /app, pre-create /app/data with minstrel
  ownership, and ENV MINSTREL_STORAGE_DATA_DIR=/app/data so the
  binary doesn't fall back to the broken "./data" default even if
  the operator forgets to set it.
- docker-compose.yml: explicit MINSTREL_STORAGE_DATA_DIR + a named
  volume mounted at /app/data so cached art persists across
  container recreates.
- cmd/minstrel/main.go: MkdirAll failure is now fatal. Silent breakage
  here cascades into every cache (playlist covers, artist art,
  album-cover fallbacks); refusing to start surfaces the misconfig
  immediately. Also wires Enricher.DataDir from cfg in preparation
  for the album-cover sidecar fallback (next commit).

Dockerfile

@@ -28,7 +28,16 @@ RUN groupadd --system --gid 1000 minstrel \
 COPY --from=builder /out/minstrel /usr/local/bin/minstrel
 COPY config.example.yaml /etc/smartmusic/config.yaml
 
+# Pre-create the data directory owned by the runtime user. Cached artifacts
+# (playlist cover collages, artist art, album-cover fallbacks) all land here.
+# A non-writable path at this location silently breaks every downstream
+# cache, so we create + chown it once at image build. Operators mount a
+# named volume on top to persist across container recreates.
+RUN mkdir -p /app/data && chown -R minstrel:minstrel /app
+WORKDIR /app
+
 USER minstrel
 EXPOSE 4533
+ENV MINSTREL_STORAGE_DATA_DIR=/app/data
 ENTRYPOINT ["/usr/local/bin/minstrel"]
 CMD ["--config", "/etc/smartmusic/config.yaml"]