radio: run liquidsoap as dedicated non-root user; quiet pulse warnings

- Liquidsoap refuses to start as root (init: security exit). Instead of
  the settings.init.allow_root override, the image now has a dedicated
  'radio' user (audio + pulse-access groups) and the entrypoint drops
  privileges via setpriv after doing its root-only work (volume seeding,
  icecast config render/start, pulse start, chown of the data volume).
  The icecast secret is made group-readable (640 root:radio) because the
  script parses it directly.
- The opam root moved from /root/.opam to /opt/opam so the liquidsoap
  binary AND its stdlib .liq files are readable by the radio user.
  NOTE: this invalidates the cached opam build layer - next build
  recompiles liquidsoap (~15-20 min).
- pulseaudio (PULSE_MODE=internal) now starts with
  --disallow-module-loading: system.pa startup modules still load, only
  later client-requested loads are blocked, and the system-mode warning
  goes away. The 'forcibly disabling SHM mode' notice is inherent to
  system mode and harmless (documented).

Keeps the user's libcurl4-gnutls-dev build-dep fix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/entrypoint.radio.sh

@@ -73,7 +73,12 @@ fi
 #   none               - you edited the script to drop pulse in/out.
 case "${PULSE_MODE:-internal}" in
     internal)
-        pulseaudio --system --daemonize=yes --disallow-exit --exit-idle-time=-1 \
+        # --disallow-module-loading: modules from system.pa still load at
+        # startup; this only blocks later client-requested loads (and
+        # silences the system-mode warning). The "forcibly disabling SHM"
+        # notice is inherent to system mode and harmless.
+        pulseaudio --system --daemonize=yes --disallow-exit \
+            --disallow-module-loading --exit-idle-time=-1 \
             || echo "WARNING: internal pulseaudio failed to start" >&2
         export PULSE_SERVER="${PULSE_SERVER:-unix:/var/run/pulse/native}"
         ;;
@@ -84,5 +89,15 @@ case "${PULSE_MODE:-internal}" in
         ;;
 esac
 
+# Liquidsoap refuses to run as root (init: security exit), so hand the data
+# volume to the dedicated 'radio' user and drop privileges for the main
+# process. The script parses the icecast secret directly, so make that one
+# file group-readable for 'radio' (kept 640, root-owned).
+chown -R radio:radio "$DATA"
+chgrp radio "$CREDS" 2>/dev/null && chmod 640 "$CREDS" || true
+if ! setpriv --reuid radio --regid radio --init-groups -- test -r "$MUSIC"; then
+    echo "WARNING: music dir $MUSIC is not readable by the 'radio' user" >&2
+fi
+
 cd "$DATA"
-exec "$@"
+exec setpriv --reuid radio --regid radio --init-groups -- "$@"