chore: Dockerfile (multi-stage, Python 3.14, non-root, healthcheck)

[constk]

Problem

Production deployments need a slim, non-root, healthcheck-ready container image. Single-stage Dockerfiles leak build tools and dev deps into the runtime; running as root is a needless attack surface.

Proposed solution

Port Teller's multi-stage Dockerfile, bumping the base to python:3.14-slim. Builder stage: install uv, uv sync --frozen --no-dev. Runtime stage: matching base, create app:app non-root user before COPY (bake ownership at write time), COPY only .venv and src/, set PATH. Add HEALTHCHECK using python -c 'import urllib.request; urllib.request.urlopen(...)' against /api/v1/health. UV_PYTHON_DOWNLOADS=never, UV_PYTHON_PREFERENCE=only-system.

Acceptance criteria

• docker build . succeeds; final image is multi-stage with non-root user.
• Image runs uvicorn src.api.main:app as non-root.
• HEALTHCHECK returns healthy when /api/v1/health returns 200 (after feat: backend scaffold (FastAPI app, /api/v1/health, /api/v1/echo, sessions) #17).
• No build tools, no pip cache, no dev deps in final image.
• Trivy scan in CI (chore: security workflow (gitleaks, pip-audit, npm audit, trivy) #11) shows no fixable HIGH/CRITICAL CVEs at merge time.

Priority rationale

High: non-root + slim base is the baseline modern practice; image size and CVE surface affect every deploy.

Depends on

#1

[constk]

Auto-close did not fire from the squash-merge body. Marking closed retrospectively — the work shipped weeks ago and the project board's Done column reflects the actual state once the project-item move that follows this comment lands.