fix(backend): use CPU-only PyTorch to shrink Docker image

[ruby0322]

Summary

• Install CPU-only PyTorch wheels in the backend Dockerfile (matching CI backend-test)
• Split torch out of requirements into requirements-core.txt to prevent CUDA wheel reinstall
• Verified local build: image ~2.76 GB (down from ~9 GB), torch 2.9.1+cpu

Test plan

• CI passes (lint, backend tests, frontend build, k8s render)
• After merge, CD Build Dev pushes new sha-* tag
• K8s dev backend pod pulls and starts without ImagePullBackOff
• /healthz and /readyz pass on new backend pod

[cursor]

Summary

Approved. This is a focused, correct fix for oversized backend images. Splitting PyTorch out of the pip requirements chain and installing CPU wheels from the PyTorch index first is the right pattern — it prevents transformers (or a pinned torch line in requirements.txt) from pulling the default CUDA build from PyPI.

What looks good

• Dockerfile installs torch/torchvision from download.pytorch.org/whl/cpu before requirements-core.txt, so later deps cannot override with CUDA wheels.
• requirements-core.txt split cleanly separates ML runtime deps from the torch install path; requirements.txt remains a convenience wrapper with clear comments.
• CI backend-test now mirrors Docker: CPU torch → requirements-core → requirements-dev. This also fixes a subtle issue on main, where requirements.txt still pinned torch==2.9.1 from PyPI and could reinstall CUDA torch after the explicit CPU install.
• Docs (apps/backend/README.md) document the CPU-only image rationale and updated local setup.
• Runtime impact: none expected — inference is already CPU-only (DEVICE=cpu).

Minor nits (non-blocking)

1. Root README.md local backend setup (around line 268) still says pip install -r requirements-dev.txt without the CPU torch pre-install step. apps/backend/README.md was updated; consider aligning the root README in a follow-up.
2. Torch version triplication — 2.9.1 / 0.24.1 appear in Dockerfile, CI, and README. Fine for now; a one-line header comment in requirements-core.txt ("install CPU torch first — see Dockerfile") would help future editors.
3. Lint CI job still installs via requirements-dev.txt only; transformers may still pull a full torch wheel transitively even though lint doesn't need it. Pre-existing / out of scope, but worth knowing for CI time.

Verification

Static review in cloud env. CI on this PR: lint, frontend tests/build, and K8s render passed; backend tests were still running at review time. Author-reported image size (~2.76 GB vs ~9 GB) matches the expected win.

Safe to merge once backend tests finish green and post-merge CD smoke (per test plan) confirms the slimmer image pulls and /healthz + /readyz pass.

  

_{Sent by Cursor Automation: PD Care PR Reviewer}

[cursor]

Consider a header comment here noting that torch/torchvision must be installed separately from the CPU wheel index before this file (see Dockerfile / CI). Without that, pip install -r requirements-core.txt alone will let transformers pull the default (CUDA) PyPI torch.

[cursor]

Install order looks correct: CPU wheels first, then requirements-core.txt. That prevents transformers from dragging in the ~9 GB CUDA build during the same layer.