fix: set HF_HOME to /app/.cache so user 1000 can read baked reranker weights

Build-time pre-download ran as root → cached in /root/.cache/huggingface.
Runtime user 1000 looked in /home/user/.cache → not found → HF_HUB_OFFLINE blocked download → crash.

Fix: set HF_HOME=/app/.cache/huggingface before pre-download step (after USER 1000),
so weights are written to and read from the same /app-owned path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -7,9 +7,6 @@ COPY requirements.txt .
 RUN pip install torch --index-url https://download.pytorch.org/whl/cpu --no-cache-dir
 RUN pip install --no-cache-dir -r requirements.txt
 
-# Bake reranker weights into image — avoids cold-start HF Hub download
-RUN python -c "from sentence_transformers import CrossEncoder; CrossEncoder('cross-encoder/ms-marco-TinyBERT-L-2-v2')"
-
 COPY server/ server/
 COPY config.yaml .
 COPY data/ground_truth/ data/ground_truth/
@@ -20,10 +17,14 @@ RUN mkdir -p data/raw logs chroma_db
 RUN useradd -m -u 1000 user && chown -R user /app
 USER user
 
-# Prevent runtime HF Hub network calls — model is baked into image
+# Cache must be under /app so user 1000 can read it at runtime
+ENV HF_HOME=/app/.cache/huggingface
 ENV HF_HUB_OFFLINE=1
 ENV TRANSFORMERS_OFFLINE=1
 
+# Bake reranker weights into image as user 1000 → written to HF_HOME above
+RUN python -c "from sentence_transformers import CrossEncoder; CrossEncoder('cross-encoder/ms-marco-TinyBERT-L-2-v2')"
+
 EXPOSE 7860
 
 CMD ["uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "7860"]