FIX: Dockerfile user+workdir order, remove unused geoip2 dep

fix: HuggingFace Spaces Dockerfile - port 7860, user 1000

fix: simplify Dockerfile - single stage, pip install direct, no user switching

fix: install packages to /usr/local so appuser can read them

fix: single worker for SQLite safety, increase healthcheck timeout to 120s

fix: point app.yaml to Ruturaj2506/demo-auth fork