[INFRA 1] Containerise the stack: Dockerfiles for API and worker, docker-compose local dev, split requirements

[m-khan-97]

Objective

Make builds reproducible and local development one-command. Today there is no Dockerfile or docker-compose anywhere in the repo — Render builds implicitly from source, and every contributor assembles Python + Postgres + env vars by hand.

Current state

• No Dockerfile, no docker-compose.yml, no .dockerignore
• startup.sh runs the background worker as a subshell inside the same container as Gunicorn
• A single requirements.txt mixes runtime, AI, and test dependencies — chromadb + sentence-transformers pull PyTorch (~2 GB) into the API image, inflating cold starts and memory on Render free tier

Scope

• Multi-stage Dockerfile (python:3.11-slim) building the API image
• Worker runs from the same image with a different entrypoint (python -m scanner.worker)
• docker-compose.yml: postgres:16 + api + worker, with healthchecks and a .env.example
• Split requirements: requirements/base.txt, ai.txt (chromadb, sentence-transformers), dev.txt (pytest) — AI deps become optional for the API image
• .dockerignore (frontend/, website/, tests/, pycache, .env)
• README quick-start updated to docker compose up

Out of scope

• Deploy pipeline / Render service topology → INFRA 4
• DB connection pooling → [FIX 2] Reliability: score endpoint 500, DB pooling, CVE timeout, query safety, thread safety #150 (REL-003)

Acceptance criteria

• docker compose up gives a working API on :5000 with migrations applied and worker polling
• API image builds without AI/test dependencies
• CI passes, base branch dev

Category

Infrastructure

[parthrohit22]

I'd Like to work on this,
expect PR by 8th July noon