feat: add container deployment, CI smoke checks, and integration guidance

[ashrafee-dev]

Depends on #86

This PR is stacked on the API hardening branch. Merge #86 first, then retarget this PR to main before merging.

Summary

• Add a non-root CPU-only Docker image with FFmpeg and dependency cache excluded from runtime layers.
• Add Compose with private Redis, read-only filesystems, resource caps, bounded temporary storage, model cache, startup preloading, and health checks. Bind the API only to host loopback for an HTTPS reverse proxy.
• Configure a single Uvicorn worker, bounded concurrency and WebSocket frames/queues, disabled compression, and no request access logs.
• Run Python tests/lint, the docs build, and a real container/Redis/FFmpeg smoke check in CI.
• Document deployment, TLS, credential rotation, quotas, advisory results, DeepSeek data flow, and the backend-gateway requirement for browser extensions. Update endpoint examples to /text and correct response types.
• Upgrade Astro/sharp and affected transitive dependencies to resolve the npm audit findings. Add current repository guidance in AGENTS.md.

Verified locally

• 40 Python tests passed; pylint app tests: 10.00/10.
• Documentation builds; npm audit reports zero vulnerabilities.
• Docker image builds on Linux ARM64.
• Compose starts healthy using the non-root, read-only configuration (Whisper preloading disabled for this smoke run).
• Real Redis enforces a shared HTTP/WebSocket quota; authenticated/unauthenticated behavior and readiness passed.
• Real FFmpeg decodes a generated WAV while inference is mocked; Whisper imports and its cache is writable.

Deployment acceptance still required

No production credentials were used and no public deployment was performed. Before public rollout, configure real credentials and HTTPS, complete the documented live DeepSeek/Whisper checks, and benchmark the default turbo model on the target host. This API provides service-to-service authentication, not end-user login for an extension.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
scamshield-api	Ready	Preview	Sep 26, 2026 7:20pm UTC
scamshield-api-fhes	Ready	Preview	Sep 26, 2026 7:20pm UTC