Fix Dockerfile for HF Spaces: run as uid 1000, copy hf CLI to /usr/local/bin

HF Spaces runs containers as uid 1000, not root. The hf CLI was only
accessible at /root/.local/bin/. Now copies it to /usr/local/bin/ and
creates a proper non-root user.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile

@@ -2,11 +2,11 @@ FROM python:3.12-slim
 
 WORKDIR /app
 
-# Install Rust hf CLI for bucket sync
+# Install Rust hf CLI for bucket sync (to /usr/local/bin so it's accessible to all users)
 RUN apt-get update && apt-get install -y curl && \
     curl -LsSf https://hf.co/cli/install.sh | bash && \
+    cp /root/.local/bin/hf /usr/local/bin/hf && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
-ENV PATH="/root/.local/bin:$PATH"
 
 # Install dependencies
 COPY pyproject.toml .
@@ -17,6 +17,10 @@ COPY backend/ backend/
 COPY frontend/ frontend/
 COPY settings.json .
 
+# HF Spaces runs as uid 1000
+RUN useradd -m -u 1000 user && chown -R user:user /app
+USER user
+
 # HF Spaces uses port 7860
 EXPOSE 7860