build(docker): appuser-owned data directories; note uv's index strategy for the docling file

A named volume mounted on /app/inputs, /app/indexes or /app/vectors inherits
the ownership of the image directory, so the image creates them as appuser;
before this the volume came up root-owned and every upload failed with a
permission error unless the container ran as root. docker-compose-standalone.yaml
still runs backend and worker as root, like docker-compose-hub.yaml, so it
also works with image tags that predate these directories.

requirements-docling.txt adds the PyTorch CPU index, which uv resolves only
with UV_INDEX_STRATEGY=unsafe-best-match (pip is unaffected); the file header
and the docs say so and point uv users at uv sync --extra docling.

scripts/export_requirements.sh

@@ -54,6 +54,10 @@ OCR_ENABLED=true with the tesseract binary (or a DeepSeek-OCR endpoint) runs
 through application/parser/file/ocr_parser.py.
 On Linux torch comes from the CPU-only PyTorch index (no CUDA stack); a GPU
 deployment can reinstall torch from PyPI on top.
+pip resolves the extra index as expected. uv only takes a package from the
+first index that lists it, and the PyTorch index carries stale copies of
+common packages, so with uv either run 'uv sync --extra docling' (the lock
+pins the index per package) or set UV_INDEX_STRATEGY=unsafe-best-match.
 Docker: --build-arg EXTRAS=docling" \
   --extra docling