fix: omit dev deps and don't run container as root

[dr460nf1r3]

Makes the image a little bit smaller and improves security.

[Fmstrat]

This is great, thank you. The one other thing this would require is to check permissions on TRACKER_FILE to make sure the node user can write to it if it exists, and cleanly error out if not (for backwards compatibility).

[dr460nf1r3]

The app now informs about this issue at startup and won't crash if it can't read/write to the path anymore. I also updated the compose.yml to include the tracker file and set it up to use the latest compose spec.