feat: add Dockerfile for HF Spaces deployment (CPU-only)

Dockerfile

@@ -0,0 +1,59 @@
+# EuropaLex — Docker / Hugging Face Spaces Deployment
+# Single-stage build: CPU-only deps + model download + Gradio launch
+#
+# Build:
+#   docker build --secret id=hf_token,env=HUGGING_FACE_HUB_TOKEN -t europalex .
+#
+# Run (local test):
+#   docker run -p 7860:7860 europalex
+
+FROM python:3.12-slim
+
+# ─── System dependencies ───────────────────────────────────────────────
+# git for huggingface-cli, build-essential for llama-cpp-python compilation
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    build-essential \
+    && rm -rf /var/lib/apt/lists/*
+
+# ─── Build secret: Hugging Face token ──────────────────────────────────
+# Mounted at /run/secrets/hf_token during docker build.
+# Used to authenticate huggingface-cli download of gated models.
+RUN --mount=type=secret,id=hf_token \
+    if [ -f /run/secrets/hf_token ]; then \
+        echo "Authenticated as $(huggingface-cli whoami --token $(cat /run/secrets/hf_token) 2>/dev/null || echo 'unknown')"; \
+    else \
+        echo "WARNING: No HUGGING_FACE_HUB_TOKEN secret provided. Model download will fail for gated models."; \
+    fi
+
+# ─── CPU-only PyTorch ──────────────────────────────────────────────────
+# Install from the official CPU wheel index to avoid ~2 GB of CUDA deps.
+RUN pip install --no-cache-dir \
+    --extra-index-url https://download.pytorch.org/whl/cpu \
+    torch>=2.1.0
+
+# ─── llama-cpp-python (CPU backend, no CUDA flags) ─────────────────────
+# Build with default CPU backend — no CUDA/MKL flags needed on slim base.
+RUN pip install --no-cache-dir \
+    llama-cpp-python>=0.3.28
+
+# ─── Other Python dependencies ─────────────────────────────────────────
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# ─── Copy project source ───────────────────────────────────────────────
+COPY . /app
+WORKDIR /app
+
+# ─── Download models at build time ─────────────────────────────────────
+# Uses the HF token secret for authenticated downloads.
+# Models are baked into the image (~26 GB total).
+RUN --mount=type=secret,id=hf_token \
+    if [ -f /run/secrets/hf_token ]; then \
+        export HUGGING_FACE_HUB_TOKEN=$(cat /run/secrets/hf_token); \
+    fi && \
+    python -m models.download_models
+
+# ─── Launch ────────────────────────────────────────────────────────────
+EXPOSE 7860
+CMD ["python", "app.py"]