fix(build): install CPU-only torch in ml image (drops ~5.6GB CUDA layer)

Dockerfile.ml

@@ -23,6 +23,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 WORKDIR /app
 
 COPY requirements-ml.txt requirements.txt ./
+# CPU-only torch: the default PyPI wheel bundles the CUDA runtime (~5.6GB
+# layer); this pipeline never uses a GPU. --index-url (not --extra-index-url)
+# guarantees only +cpu wheels are considered, so no nvidia-*-cu12 deps.
+RUN pip install --index-url https://download.pytorch.org/whl/cpu \
+        "torch>=2.12,<3.0" "torchvision>=0.27,<0.28"
 RUN pip install -r requirements-ml.txt
 
 COPY backend/ ./backend/

requirements-ml.txt

@@ -2,15 +2,18 @@
 
 # ML stack — versions current as of 2026-05-14 with Python 3.14 wheel coverage.
 
-torch>=2.12,<3.0
-
+# torch + torchvision are NOT listed here: they are installed CPU-only from
+# the PyTorch CPU index in Dockerfile.ml. The default PyPI torch wheel bundles
+# the NVIDIA CUDA runtime (a ~5.6GB image layer); this pipeline is CPU-only,
+# so Dockerfile.ml uses the +cpu wheels from
+# https://download.pytorch.org/whl/cpu instead.
+#
 # IMPORTANT: torchvision 0.27 declares requires_python "!=3.14.1,>=3.10" —
 # Python 3.14.1 specifically is excluded due to a known incompatibility.
 # The python-ci runner pulls python:3.14-bookworm (latest patch); if that
 # resolves to 3.14.1 the install will fail. Pin a specific Python patch in
 # the runner image (CI-Runner/CI-python/Dockerfile) if this becomes a
 # blocker. 3.14.0 and 3.14.2+ are fine.
-torchvision>=0.27,<0.28
 
 transformers>=5.8,<6.0
 onnxruntime>=1.26,<2.0