harden delivery pipeline and production runtime

Dockerfile

@@ -1,15 +1,27 @@
 FROM python:3.13-slim
 
-ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    SILLYHOME_MODEL_STORE=/app/data/models
 
 WORKDIR /app
 
-COPY pyproject.toml ./
-RUN python -m pip install --upgrade pip && \
-    pip install --no-cache-dir -e ".[dev]"
+RUN addgroup --system sillyhome && adduser --system --ingroup sillyhome sillyhome
 
-COPY . .
+COPY pyproject.toml README.md ./
+COPY app ./app
+COPY backend ./backend
+RUN python -m pip install --upgrade pip && \
+    python -m pip install . && \
+    mkdir -p /app/data/models && \
+    chown -R sillyhome:sillyhome /app/data
 
 EXPOSE 8000
 
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
+USER sillyhome
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+    CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=2)"]
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]