build(docker): slim backend image, static frontend image, -docling variant

Backend (arc53/docsgpt): 4.5 GB compressed -> 0.9 GB with both embedding
models and tiktoken baked in.
- torch/transformers gone from the default install (docling extra only).
- Ubuntu 24.04 ships python3.12: no deadsnakes PPA, no software-properties-
  common; every pin is a wheel, so no gcc/g++/rust in the builder.
- COPY --chown and a prefetch that runs as the process user replace the
  trailing chown -R, which duplicated the 600 MB model layer.
- .dockerignore keeps __pycache__, .coverage, local indexes and .env out.
- EXTRAS build arg (INSTALL_DOCLING kept as an alias); the docling variant
  also bakes docling's layout/table/RapidOCR models (DOCLING_ARTIFACTS_PATH)
  and tesseract, and drops only the discovery documents of Google APIs the
  app never builds.
- FLASK_DEBUG env removed (unused); OCI labels added.

Frontend (arc53/docsgpt-fe): 302 MB Vite dev server -> 25 MB static build
behind nginx. VITE_* variables are injected at container start into
/config.js and read through src/env.ts, so the image no longer needs a
rebuild per deployment; docker-compose.yaml keeps hot reload via the dev
target.

Publishing: every release and develop build now pushes a slim tag and a
-docling tag (docling engine + models + tesseract). docker-compose-hub.yaml
takes DOCSGPT_IMAGE_TAG / DOCSGPT_IMAGE_VARIANT; docker-compose-standalone.yaml
runs the stack from pre-built images without a checkout and is attached to
each release. setup.sh selects the -docling variant for OCR instead of
requiring a local build. A new workflow builds the image on PRs that touch
it and runs verify_offline under --network none; lint checks the exported
requirements match uv.lock.

frontend/docker/40-runtime-env.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+# Expose the container's VITE_* environment to the static bundle.
+#
+# nginx's entrypoint runs everything in /docker-entrypoint.d before serving.
+# The generated /config.js is loaded by index.html ahead of the app bundle and
+# read by src/env.ts, so VITE_API_HOST and friends can differ per deployment
+# without rebuilding the image.
+set -eu
+
+out=/usr/share/nginx/html/config.js
+{
+  printf 'window.__DOCSGPT_ENV__ = {'
+  first=1
+  env | grep -E '^VITE_[A-Za-z0-9_]+=' | while IFS='=' read -r key value; do
+    # JSON-escape backslashes and double quotes; values are plain URLs/ids.
+    escaped=$(printf '%s' "$value" | sed 's/\\/\\\\/g; s/"/\\"/g')
+    if [ "$first" -eq 1 ]; then first=0; else printf ','; fi
+    printf '"%s":"%s"' "$key" "$escaped"
+  done
+  printf '};\n'
+} > "$out"
+
+echo "runtime-env: wrote $(grep -o 'VITE_[A-Za-z0-9_]*' "$out" | wc -l | tr -d ' ') VITE_* values to /config.js"

frontend/docker/nginx.conf

@@ -0,0 +1,25 @@
+server {
+    listen 5173;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    gzip on;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+
+    # Hashed bundle assets are immutable; index.html and config.js are not.
+    location /assets/ {
+        add_header Cache-Control "public, max-age=31536000, immutable";
+        try_files $uri =404;
+    }
+
+    location = /config.js {
+        add_header Cache-Control "no-store";
+    }
+
+    # Single-page app: every unknown path renders index.html.
+    location / {
+        add_header Cache-Control "no-cache";
+        try_files $uri $uri/ /index.html;
+    }
+}