Dockerize backend for cloud deployment

[princerm06]

Summary

• package the FastAPI backend in a Python 3.12 Docker image
• add deployment-safe environment configuration
• require explicit CORS origins in production while preserving simple local development
• add /health for container/platform health checks
• enable SQLAlchemy pool_pre_ping for stale cloud connection recovery
• lazy-load the sentence-transformers model only on the first search/save that needs embeddings
• add GitHub Actions Docker build + container health smoke testing
• add .dockerignore, .env.example, deployment documentation, and config/model-loading tests

Product / engineering intent

Milestone 5A is the first cloud/SWE milestone. It makes the backend portable and cloud-ready without changing retrieval behavior.

Why lazy model loading

FastAPI can now start and answer lightweight endpoints such as /health without immediately loading the embedding model into memory. The model is initialized once, on the first embedding request, and then cached for subsequent requests. This improves startup/cold-start behavior while preserving the same model and embeddings.

Security

• no credentials committed
• .env remains ignored
• production refuses wildcard CORS
• no database/schema migration
• no public endpoint is deployed by this PR
• CI smoke tests use only a dummy database URL and do not receive Supabase secrets

Verification

GitHub Actions now runs:

1. backend unit/config/model-loading tests
2. a real Docker build
3. a container startup
4. a live /health HTTP check against the running container

The local Docker Desktop issue is therefore no longer required to validate the container itself.