Deploy CropGuard demo panel

Dockerfile

@@ -25,7 +25,19 @@ EXPOSE 7860
 
 # fileWatcherType=none because nothing edits the source at runtime, and the watcher costs CPU
 # that the free tier would rather spend on inference.
+#
+# XSRF protection is off, and that is required rather than lazy. Spaces serves the app inside
+# an iframe on huggingface.co, so Streamlit's XSRF cookie is a third-party cookie and modern
+# browsers drop it. The token then never reaches /_stcore/upload_file, which rejects every
+# upload with 403 - the file uploader is simply broken with it on. CORS goes with it because
+# Streamlit ignores enableCORS=false while XSRF is enabled, so the pair has to move together.
+#
+# What that costs: a third-party page could POST a file to this app. There is no auth, no
+# stored state and no cross-user data here - one anonymous visitor cannot reach another's
+# session - so the exposure is an unwanted inference, not a leak.
 CMD ["streamlit", "run", "app/streamlit_app.py", \
      "--server.port=7860", "--server.address=0.0.0.0", \
      "--server.headless=true", "--server.fileWatcherType=none", \
+     "--server.enableXsrfProtection=false", "--server.enableCORS=false", \
+     "--server.maxUploadSize=10", \
      "--browser.gatherUsageStats=false"]