feat: add Dockerfile.ml — separate image for the ml-worker role

ML deps (torch, transformers, onnxruntime, opencv) are ~4GB and stay out
of the regular web/worker image. Models self-heal into /models on start
(implemented in FC-2). HuggingFace cache vars point inside /models so
weight downloads are persistent across restarts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile.ml

@@ -0,0 +1,38 @@
+# syntax=docker/dockerfile:1.7
+
+FROM python:3.12-slim
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    HF_HOME=/models/.huggingface \
+    TRANSFORMERS_CACHE=/models/.huggingface \
+    ML_MODEL_DIR=/models
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ffmpeg \
+        libpq5 \
+        libjpeg62-turbo \
+        libwebp7 \
+        libpng16-16 \
+        libgl1 \
+        libglib2.0-0 \
+        ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements-ml.txt requirements.txt ./
+RUN pip install -r requirements-ml.txt
+
+COPY backend/ ./backend/
+COPY alembic/ ./alembic/
+COPY alembic.ini ./
+COPY entrypoint.sh ./
+RUN chmod +x entrypoint.sh
+
+# Models self-heal into /models on first start (FC-2 implements this)
+VOLUME ["/models"]
+
+ENTRYPOINT ["./entrypoint.sh"]
+CMD ["ml-worker"]