fix(deploy): writable data_dir in container + fatal-on-mkdir

The Dockerfile created the minstrel user but never set a WORKDIR or
pre-created a writable data dir. With the default DataDir of "./data"
and CWD of "/", every MkdirAll attempt failed with "permission denied"
under the non-root user, and the boot code only logged a Warn before
continuing. Result: every artist-art enrichment failed at
"mkdir artist-art: mkdir data: permission denied"; the operator saw
"0 successes" with no signal as to why.

Three changes:
- Dockerfile: WORKDIR /app, pre-create /app/data with minstrel
  ownership, and ENV MINSTREL_STORAGE_DATA_DIR=/app/data so the
  binary doesn't fall back to the broken "./data" default even if
  the operator forgets to set it.
- docker-compose.yml: explicit MINSTREL_STORAGE_DATA_DIR + a named
  volume mounted at /app/data so cached art persists across
  container recreates.
- cmd/minstrel/main.go: MkdirAll failure is now fatal. Silent breakage
  here cascades into every cache (playlist covers, artist art,
  album-cover fallbacks); refusing to start surfaces the misconfig
  immediately. Also wires Enricher.DataDir from cfg in preparation
  for the album-cover sidecar fallback (next commit).

docker-compose.yml

@@ -38,6 +38,7 @@ services:
       MINSTREL_LOG_FORMAT: text
       MINSTREL_LIBRARY_SCAN_PATHS: /music
       MINSTREL_LIBRARY_SCAN_ON_STARTUP: "true"
+      MINSTREL_STORAGE_DATA_DIR: /app/data
       # MINSTREL_AUTH_ADMIN_PASSWORD left unset on purpose — bootstrap
       # generates one and prints it to stderr on first boot. Watch the logs
       # of the minstrel service the first time you bring the stack up.
@@ -49,9 +50,14 @@ services:
       # Point ./music at your test library (symlink, bind-mount, whatever).
       # Read-only so a buggy scanner can't rewrite your files.
       - /mnt/Media/Music:/music:ro
+      # Cached artifacts: playlist cover collages, artist art, album-cover
+      # fallbacks (when the music dir is RO). Persists across container
+      # recreates so the operator doesn't redownload art on every up/down.
+      - minstrel-data:/app/data
 
 volumes:
   minstrel-pgdata:
+  minstrel-data:
 
 networks:
   minstrel: