fix: remove unnecessary image layers

[YC]

• Remove copy of ca-certificates, zoneinfo since the base image already has it
• Make the /app directory read only

Testing

• Can fetch https://wakatime.com/
• Can determine time using timezone

// Test code written with help from AI

// get https://wakatime.com
res, err := http.Get("https://wakatime.com")
if err != nil {
	conf.Log().Fatal(err.Error())
}
defer res.Body.Close()
body, err := io.ReadAll(res.Body)
if err != nil {
	conf.Log().Fatal(err.Error())
}
conf.Log().Info("Successfully fetched https://wakatime.com - your server can access the Wakatime API", "statusCode", res.StatusCode, "responseLength", len(body))

// check time location can be loaded
timeLocation, err := time.LoadLocation("America/New_York")
if err != nil {
	conf.Log().Fatal(err.Error())
}
conf.Log().Info("Successfully loaded time location", "location", timeLocation.String(), "currentTime", time.Now().In(timeLocation).String())

Output:

{"time":"2026-04-03T08:42:43.792487718Z","level":"INFO","msg":"Successfully fetched https://wakatime.com - your server can access the Wakatime API","statusCode":200,"responseLength":85446}
{"time":"2026-04-03T08:42:43.792915789Z","level":"INFO","msg":"Successfully loaded time location","location":"America/New_York","currentTime":"2026-04-03 04:42:43.792891408 -0400 EDT"}