Fix fresh-install schema gap and OIDC provider CA trust

- Session::prepareTablesIfNeeded(): Wt::Dbo's automatic createTables()
  silently fails to create 4 tables (share, starred_artist,
  starred_release, starred_track) on a genuinely fresh database, with
  no exception raised and no clear reason found in Wt::Dbo internals.
  These tables are otherwise only ever created via historical schema
  migrations, which never run for a fresh install (new DBs are stamped
  directly at LMS_DATABASE_VERSION). Reproduced consistently across
  multiple from-scratch database attempts. Added defensive
  CREATE TABLE IF NOT EXISTS statements for all 4 right after
  createTables() as a targeted workaround; harmless no-op on databases
  where they already exist correctly.

- Dockerfile-release / docker-entrypoint.sh: the OIDC token exchange
  (OAuthProcess::handleToken(), a server-to-server HTTPS call from LMS
  to the provider's token endpoint) has no way to trust a private/
  internal CA, so any OIDC provider behind non-publicly-trusted TLS
  fails with 'certificate verify failed' immediately after the user
  authenticates - the callback silently drops back to the login page
  with no user-visible error, and no account ever gets created (the
  auto-registration logic in OIDCAuth::OIDCAuth was already correct;
  it just never got a chance to run). Added ca-certificates + su-exec
  to the runtime image and a docker-entrypoint.sh that runs
  update-ca-certificates against anything mounted into
  /usr/local/share/ca-certificates before dropping privileges and
  exec'ing lms, so operators can trust a custom CA via a volume mount.

Dockerfile-release

@@ -155,6 +155,7 @@ ARG	RUNTIME_PACKAGES=" \
 	boost-iostreams \
 	boost-program_options \
 	boost-thread \
+	ca-certificates \
 	lame-libs \
 	libarchive \
 	libconfig++ \
@@ -170,6 +171,7 @@ ARG	RUNTIME_PACKAGES=" \
 	opus \
 	pugixml \
 	sqlite-libs \
+	su-exec \
 	zlib"
 
 ARG	LMS_USER=lms
@@ -191,12 +193,16 @@ RUN	addgroup -S ${LMS_GROUP} && \
 VOLUME	/var/lms
 VOLUME	/music
 VOLUME	/usr/local/etc
-
-USER	${LMS_USER}:${LMS_GROUP}
+VOLUME	/usr/local/share/ca-certificates
 
 COPY	--from=build /tmp/fakeroot/ /usr
 COPY	--from=build /tmp/fakeroot/share/lms/lms.conf /etc/lms.conf
+COPY	docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN	chmod +x /usr/local/bin/docker-entrypoint.sh
 
 EXPOSE	5082
 
-ENTRYPOINT	["/usr/bin/lms"]
+# Stays root so the entrypoint can run update-ca-certificates; it drops to
+# ${LMS_USER}:${LMS_GROUP} via su-exec before running lms itself.
+ENTRYPOINT	["/usr/local/bin/docker-entrypoint.sh"]
+CMD	["/usr/bin/lms"]