fix: fail fast on unwritable Docker DB path

[prakersh]

Summary

• add preflightDatabasePath() before SQLite init to detect unwritable DB paths with actionable guidance instead of opaque SQLite OOM/pragma errors
• handle both failure classes: unwritable DB directory and existing read-only/root-owned onwatch.db
• preserve valid SQLite DSNs (file:/...?. and mode=memory) and add regression tests for URI-based paths
• restore recursive bind-mount ownership guidance in Docker docs/comments (chown -R 65532:65532)

Follow-up to #22.

Test plan

• go test -race ./internal/store/... -run "PreflightDatabasePath|StoreNew_SQLiteFileURI" -v
• go test -race ./... -count=1
• go vet ./...
• Docker writable bind mount: container starts and opens /data/onwatch.db
• Docker existing read-only /data/onwatch.db (0444): fails fast with database file is not writable + remediation hint
• Docker named volume: container starts successfully

[codecov]

Codecov Report

❌ Patch coverage is 53.70370% with 25 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/store/store.go	53.70%	16 Missing and 9 partials ⚠️

📢 Thoughts on this report? Let us know!