fix(docker): pin SurrealDB version and fix single-container docs (#629)

- Replace curl-based SurrealDB install in Dockerfile.single with a
  multi-stage build that copies the binary from surrealdb/surrealdb:v2,
  aligning it with the version used in docker-compose.yml and preventing
  breakage when newer SurrealDB versions introduce syntax changes.
- Fix SURREAL_PASSWORD documentation in single-container.md: the actual
  password set in supervisord.single.conf is `root`, not `password`.

Closes #498

docs/1-INSTALLATION/single-container.md

@@ -31,7 +31,7 @@ services:
       - OPEN_NOTEBOOK_ENCRYPTION_KEY=change-me-to-a-secret-string
       - SURREAL_URL=ws://localhost:8000/rpc
       - SURREAL_USER=root
-      - SURREAL_PASSWORD=password
+      - SURREAL_PASSWORD=root
       - SURREAL_NAMESPACE=open_notebook
       - SURREAL_DATABASE=open_notebook
     volumes:
@@ -106,7 +106,7 @@ heroku config:set OPEN_NOTEBOOK_ENCRYPTION_KEY=your-secret-key
 | `OPEN_NOTEBOOK_ENCRYPTION_KEY` | Encryption key for credentials (required) | `my-secret-key` |
 | `SURREAL_URL` | Database | `ws://localhost:8000/rpc` |
 | `SURREAL_USER` | DB user | `root` |
-| `SURREAL_PASSWORD` | DB password | `password` |
+| `SURREAL_PASSWORD` | DB password | `root` |
 | `SURREAL_NAMESPACE` | DB namespace | `open_notebook` |
 | `SURREAL_DATABASE` | DB name | `open_notebook` |
 | `API_URL` | External URL (for remote access) | `https://myapp.example.com` |