feat: ml-worker self-heals models; restore modal tag-input auto-focus

ml-worker now fetches WD14 + SigLIP on container start via an entrypoint
script that calls huggingface_hub with a populated local_dir. HF does a
content-based integrity check, so subsequent starts are a no-op. Transient
HF outages warn and continue when a local copy is already present. This
drops the baked-in model layer (~4 GB) from the image so it pushes cleanly
through registry proxies and no longer bloats every tagged release.

view-modal.js restores the desktop-only auto-focus of the tag input on
openModal (with touch-device guard). The block existed in an earlier
main commit (0bf1961) but was absent from the post-corruption
consolidation commit.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Dockerfile.ml

@@ -22,14 +22,9 @@ RUN pip install --no-cache-dir \
         --index-url https://download.pytorch.org/whl/cpu \
         "torch>=2.5"
 
-# Pre-install only what the model downloader needs, then fetch models. By keeping the model-download
-# layer above the full requirements install, a change to requirements-ml.txt won't invalidate the
-# (slow, ~2 GB) model download layer.
-RUN pip install --no-cache-dir "huggingface_hub>=0.25"
-COPY scripts/download_models.py /app/scripts/download_models.py
-RUN mkdir -p ${ML_MODEL_DIR} && python /app/scripts/download_models.py
-
-# Install the rest of the ML requirements. Model files are already on disk from the step above.
+# Install ML requirements. Models are NOT baked in — the entrypoint fetches them
+# at container start into the ${ML_MODEL_DIR} volume, and huggingface_hub's
+# content-based integrity check makes subsequent starts a no-op.
 COPY requirements-ml.txt /app/requirements-ml.txt
 RUN pip install --no-cache-dir -r requirements-ml.txt
 
@@ -37,6 +32,9 @@ RUN pip install --no-cache-dir -r requirements-ml.txt
 # config.py lives at the repo root and is imported by app/__init__.py via 'config.Config'.
 COPY app /app/app
 COPY config.py /app/config.py
+COPY scripts/ensure_models.py /app/scripts/ensure_models.py
+COPY scripts/entrypoint-ml.sh /app/scripts/entrypoint-ml.sh
+RUN chmod +x /app/scripts/entrypoint-ml.sh && mkdir -p ${ML_MODEL_DIR}
 
-# Celery needs these env vars set at runtime via docker-compose.
+ENTRYPOINT ["/app/scripts/entrypoint-ml.sh"]
 CMD ["celery", "-A", "app.celery_app:celery", "worker", "--loglevel=info", "-Q", "ml", "--concurrency=1"]