Fix Dockerfile: use slim base, add git/ffmpeg, PyTorch extra-index-url, non-root user

Dockerfile

@@ -1,7 +1,27 @@
-FROM python:3.10
-WORKDIR /app
-COPY requirements.txt .
-RUN pip install -r requirements.txt
-COPY . .
-EXPOSE 7860
-CMD ["python", "app.py"]
+FROM python:3.10-slim
+
+WORKDIR /app
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    git-lfs \
+    ffmpeg \
+    libsm6 \
+    libxext6 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy and install Python dependencies
+COPY requirements.txt .
+RUN pip install --no-cache-dir --extra-index-url https://download.pytorch.org/whl/cpu -r requirements.txt
+
+# Copy app files
+COPY . .
+
+# Create non-root user for HF Spaces
+RUN useradd -m -u 1000 user
+USER user
+
+EXPOSE 7860
+
+CMD ["python", "app.py"]