feat: HF Spaces Docker deployment — non-root user, model pre-download, keep-alive timeout

Changes Pro max

feat: lightweight RAG with Pinecone + Gemini embeddings + Render deploy

newww