Fix Dockerfile: single-stage build so gunicorn binary is in PATH

Production readiness: port 7860, Dockerfile, HF Spaces config