Add SHA256 checksum verification for windwatts_data wheel

[Copilot]

Addresses security vulnerability where windwatts_data wheel is downloaded from S3 without integrity verification, allowing potential arbitrary code execution if the S3 object is compromised.

Changes

• Dockerfile: Added optional WINDWATTS_DATA_SHA256 build arg with checksum verification via sha256sum -c. Fails build on mismatch, warns if omitted.
• docker-compose.yml: Passes WINDWATTS_DATA_SHA256 environment variable to build context.
• Documentation: Added SHA256 verification steps in backend setup, quickstart, and deployment guides with security notes.

Usage

# Recommended: Build with checksum verification
docker build \
  --build-arg WINDWATTS_DATA_URL=https://windwatts-era5.s3.us-west-2.amazonaws.com/ \
  --build-arg WINDWATTS_DATA_SHA256=<expected_sha256_checksum> \
  -t windwatts-api:latest .

# Manual verification
curl -O https://windwatts-era5.s3.us-west-2.amazonaws.com/windwatts_data-1.0.4-py3-none-any.whl
sha256sum windwatts_data-1.0.4-py3-none-any.whl
# Verify output matches expected checksum before installing

Backward compatible: checksum verification is optional but strongly recommended.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.