Switch HF Space SDK from streamlit to docker

HF removed Streamlit as a top-level Space SDK; the supported path is now
Docker SDK with a user-provided Dockerfile.

- Dockerfile: python:3.10-slim, runs as user 1000 (HF Spaces convention),
installs requirements.txt, pre-warms BAAI/bge-small-en-v1.5 at build
time so first request is fast, exposes port 7860, launches Streamlit
bound to 0.0.0.0 with CORS/XSRF relaxed for HF's reverse proxy.
- README.md frontmatter: sdk -> docker, app_port -> 7860, drop the
streamlit-specific keys.

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile

@@ -0,0 +1,38 @@
+FROM python:3.10-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    HF_HOME=/home/user/.cache/huggingface \
+    SENTENCE_TRANSFORMERS_HOME=/home/user/.cache/huggingface \
+    STREAMLIT_SERVER_HEADLESS=true \
+    STREAMLIT_BROWSER_GATHERUSAGESTATS=false
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential \
+        git \
+    && rm -rf /var/lib/apt/lists/*
+
+# HF Spaces convention: run as non-root user 1000
+RUN useradd -m -u 1000 user
+USER user
+ENV PATH="/home/user/.local/bin:${PATH}"
+WORKDIR /home/user/app
+
+COPY --chown=user requirements.txt ./
+RUN pip install --user --upgrade pip && \
+    pip install --user --no-cache-dir -r requirements.txt
+
+COPY --chown=user . ./
+
+# Pre-warm the embedding model at build time so first request is fast and
+# doesn't hit a cold HF download from inside the running container.
+RUN python -c "from sentence_transformers import SentenceTransformer; SentenceTransformer('BAAI/bge-small-en-v1.5')"
+
+EXPOSE 7860
+
+CMD ["streamlit", "run", "app.py", \
+     "--server.port=7860", \
+     "--server.address=0.0.0.0", \
+     "--server.enableCORS=false", \
+     "--server.enableXsrfProtection=false"]

README.md

@@ -3,10 +3,8 @@ title: EPCC Contract Intelligence
 emoji: 📑
 colorFrom: blue
 colorTo: indigo
-sdk: streamlit
-sdk_version: "1.36.0"
-app_file: app.py
-python_version: "3.10"
+sdk: docker
+app_port: 7860
 pinned: false
 license: mit
 short_description: Local clause/risk classifier for EPCC contract triage