fix: move HF_HUB_OFFLINE after reranker pre-download

Offline flags blocked the build-time download itself. Download must run
without offline flags, then set them afterward to prevent runtime network calls.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -17,14 +17,16 @@ RUN mkdir -p data/raw logs chroma_db
 RUN useradd -m -u 1000 user && chown -R user /app
 USER user
 
-# Cache must be under /app so user 1000 can read it at runtime
+# Cache under /app so user 1000 owns it at both build and runtime
 ENV HF_HOME=/app/.cache/huggingface
-ENV HF_HUB_OFFLINE=1
-ENV TRANSFORMERS_OFFLINE=1
 
-# Bake reranker weights into image as user 1000 → written to HF_HOME above
+# Download reranker as user 1000 — offline flags NOT set yet so download works
 RUN python -c "from sentence_transformers import CrossEncoder; CrossEncoder('cross-encoder/ms-marco-TinyBERT-L-2-v2')"
 
+# Block runtime network calls — model already in HF_HOME cache
+ENV HF_HUB_OFFLINE=1
+ENV TRANSFORMERS_OFFLINE=1
+
 EXPOSE 7860
 
 CMD ["uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "7860"]