fix(cv): isolate document parsing

Run untrusted document decoders in a secret-free, resource-bounded child process and terminate its process tree on deadline. Harden the production container and enforce parser and lint gates in CI.

docker-compose.yml

@@ -170,6 +170,10 @@ services:
       - EXTERNAL_AI_MAX_PROMPT_CHARS=${EXTERNAL_AI_MAX_PROMPT_CHARS:-24000}
       - LOCAL_AI_CIRCUIT_FAILURE_THRESHOLD=${LOCAL_AI_CIRCUIT_FAILURE_THRESHOLD:-3}
       - LOCAL_AI_CIRCUIT_OPEN_SECONDS=${LOCAL_AI_CIRCUIT_OPEN_SECONDS:-30}
+      - PARSER_TIMEOUT_SECONDS=${PARSER_TIMEOUT_SECONDS:-25}
+      - PARSER_CPU_SECONDS=${PARSER_CPU_SECONDS:-20}
+      - PARSER_MEMORY_MIB=${PARSER_MEMORY_MIB:-512}
+      - PARSER_STALE_WORK_SECONDS=${PARSER_STALE_WORK_SECONDS:-3600}
       - GEMINI_API_KEY=${GEMINI_API_KEY:-}
       - GEMINI_MODEL=${GEMINI_MODEL:-gemini-2.0-flash}
       - GROQ_API_KEY=${GROQ_API_KEY:-}
@@ -184,6 +188,18 @@ services:
     # re-adding a `ports:` here.
     expose:
       - "8001"
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 96
+    mem_limit: 2g
+    cpus: 2.0
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,nodev,size=768m,mode=1777
+    volumes:
+      - ai_model_cache:/home/app/.cache/huggingface
     # ai_internal ONLY. Not on `default` (which the frontend shares) and not on
     # `shared_services` (which is `external: true`, so any other compose stack on this host can
     # join it and would then be able to reach this service). ai_internal carries exactly two
@@ -242,6 +258,7 @@ volumes:
   jobtracker_data:
   jobtracker_deletion_tombstones:
   ollama_data:
+  ai_model_cache:
 
 networks:
   shared_services: