build(docker): slim backend image, static frontend image, -docling variant

Backend (arc53/docsgpt): 4.5 GB compressed -> 0.9 GB with both embedding
models and tiktoken baked in.
- torch/transformers gone from the default install (docling extra only).
- Ubuntu 24.04 ships python3.12: no deadsnakes PPA, no software-properties-
  common; every pin is a wheel, so no gcc/g++/rust in the builder.
- COPY --chown and a prefetch that runs as the process user replace the
  trailing chown -R, which duplicated the 600 MB model layer.
- .dockerignore keeps __pycache__, .coverage, local indexes and .env out.
- EXTRAS build arg (INSTALL_DOCLING kept as an alias); the docling variant
  also bakes docling's layout/table/RapidOCR models (DOCLING_ARTIFACTS_PATH)
  and tesseract, and drops only the discovery documents of Google APIs the
  app never builds.
- FLASK_DEBUG env removed (unused); OCI labels added.

Frontend (arc53/docsgpt-fe): 302 MB Vite dev server -> 25 MB static build
behind nginx. VITE_* variables are injected at container start into
/config.js and read through src/env.ts, so the image no longer needs a
rebuild per deployment; docker-compose.yaml keeps hot reload via the dev
target.

Publishing: every release and develop build now pushes a slim tag and a
-docling tag (docling engine + models + tesseract). docker-compose-hub.yaml
takes DOCSGPT_IMAGE_TAG / DOCSGPT_IMAGE_VARIANT; docker-compose-standalone.yaml
runs the stack from pre-built images without a checkout and is attached to
each release. setup.sh selects the -docling variant for OCR instead of
requiring a local build. A new workflow builds the image on PRs that touch
it and runs verify_offline under --network none; lint checks the exported
requirements match uv.lock.

setup.ps1

@@ -513,29 +513,32 @@ function Configure-DocProcessing {
         Write-ColorText "PDF-as-image parsing enabled." -ForegroundColor "Green"
     }
 
-    # OCR needs the tesseract binary, an optional system package that only
-    # locally built images can include (INSTALL_TESSERACT build arg). The
-    # pre-built Docker Hub images ship without it, so there OCR stays off
-    # (its default) rather than being switched on to fail on every scan.
-    if ($COMPOSE_FILE -ne $COMPOSE_FILE_LOCAL) {
-        Write-ColorText "OCR for scanned PDFs and images stays off: the pre-built Docker Hub images do not include tesseract. To use OCR, rerun setup and choose option 5 (build images locally), or use a DeepSeek-OCR endpoint by adding OCR_ENABLED=true, OCR_ENGINE=deepseek and OCR_DEEPSEEK_URL=<endpoint> to .env." -ForegroundColor "Yellow"
+    # OCR needs the tesseract binary. The default (slim) images ship without
+    # it; the pre-built "-docling" image variant bakes tesseract, the docling
+    # layout engine and its models in, so with Docker Hub images OCR means
+    # switching the variant. Locally built images get it via build args.
+    $ocr_enabled = Read-Host "Enable OCR for scanned PDFs and images? (y/N)"
+    if (-not ($ocr_enabled -eq "y" -or $ocr_enabled -eq "Y")) {
         return
     }
-
-    $ocr_enabled = Read-Host "Enable OCR for scanned PDFs and images? (y/N)"
-    if ($ocr_enabled -eq "y" -or $ocr_enabled -eq "Y") {
-        "OCR_ENABLED=true" | Add-Content -Path $ENV_FILE -Encoding utf8
-        # Bakes tesseract into the locally built images (docker compose
-        # --env-file .env build).
-        "INSTALL_TESSERACT=true" | Add-Content -Path $ENV_FILE -Encoding utf8
-        Write-ColorText "OCR enabled. tesseract will be built into the images (INSTALL_TESSERACT=true); for a DeepSeek-OCR endpoint instead, set OCR_ENGINE=deepseek and OCR_DEEPSEEK_URL=<endpoint> in .env." -ForegroundColor "Green"
-        $docling_ocr = Read-Host "Also install the Docling layout engine for OCR (better tables/reading order, several GB heavier)? (y/N)"
-        if ($docling_ocr -eq "y" -or $docling_ocr -eq "Y") {
-            # Locally built images include docling via this build arg; it becomes
-            # the OCR backend automatically (OCR_BACKEND=auto).
-            "INSTALL_DOCLING=true" | Add-Content -Path $ENV_FILE -Encoding utf8
-            Write-ColorText "Docling will be built into locally built images (docker compose --env-file .env build). Pre-built Docker Hub images do not include it." -ForegroundColor "Green"
-        }
+    "OCR_ENABLED=true" | Add-Content -Path $ENV_FILE -Encoding utf8
+    if ($COMPOSE_FILE -ne $COMPOSE_FILE_LOCAL) {
+        # Pre-built images: pull arc53/docsgpt:<tag>-docling instead of the
+        # slim default (about 1.5 GB more to download).
+        "DOCSGPT_IMAGE_VARIANT=-docling" | Add-Content -Path $ENV_FILE -Encoding utf8
+        Write-ColorText "OCR enabled. The -docling image variant will be pulled (tesseract, docling layout engine and its models included). For a DeepSeek-OCR endpoint instead, set OCR_ENGINE=deepseek and OCR_DEEPSEEK_URL=<endpoint> in .env." -ForegroundColor "Green"
+        return
+    }
+    # Bakes tesseract into the locally built images (docker compose
+    # --env-file .env build).
+    "INSTALL_TESSERACT=true" | Add-Content -Path $ENV_FILE -Encoding utf8
+    Write-ColorText "OCR enabled. tesseract will be built into the images (INSTALL_TESSERACT=true); for a DeepSeek-OCR endpoint instead, set OCR_ENGINE=deepseek and OCR_DEEPSEEK_URL=<endpoint> in .env." -ForegroundColor "Green"
+    $docling_ocr = Read-Host "Also install the Docling layout engine for OCR (better tables/reading order, several GB heavier)? (y/N)"
+    if ($docling_ocr -eq "y" -or $docling_ocr -eq "Y") {
+        # Locally built images include docling via this build arg; it becomes
+        # the OCR backend automatically (OCR_BACKEND=auto).
+        "INSTALL_DOCLING=true" | Add-Content -Path $ENV_FILE -Encoding utf8
+        Write-ColorText "Docling will be built into locally built images (docker compose --env-file .env build)." -ForegroundColor "Green"
     }
 }