fix: remove build-time model download — HF secrets unavailable at build time

Dockerfile

@@ -1,7 +1,5 @@
 FROM python:3.11-slim
 
-# HuggingFace Spaces runs as a non-root user
-RUN useradd -m -u 1000 user
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -9,42 +7,25 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 # Python deps
-COPY --chown=user requirements.txt ./
+COPY requirements.txt ./
 RUN pip install --no-cache-dir -r requirements.txt
 
 # App source
-COPY --chown=user . .
+COPY . .
 
 # ---------------------------------------------------------------------------
-# Pre-download model into the image at build time so startup is instant.
-# Pass --build-arg HF_TOKEN=<your_token> to authenticate during build.
-# On HuggingFace Spaces, set HF_TOKEN as a Space secret.
+# Runtime environment — model is downloaded on first startup using HF_TOKEN
+# secret set in Space settings (Spaces secrets are NOT available at build time)
 # ---------------------------------------------------------------------------
-ARG HF_TOKEN=""
 ENV MODEL_ID=gsstec/LFM2-700M
 ENV HF_HOME=/app/model_cache
 ENV TRANSFORMERS_CACHE=/app/model_cache
 ENV HF_HUB_DISABLE_PROGRESS_BARS=1
 
-RUN HF_TOKEN="${HF_TOKEN}" \
-    HUGGING_FACE_HUB_TOKEN="${HF_TOKEN}" \
-    python - <<'EOF'
-from transformers import AutoModelForCausalLM, AutoTokenizer
-import os
-model_id = os.environ["MODEL_ID"]
-token = os.environ.get("HF_TOKEN") or None
-print(f"Pre-downloading {model_id} (authenticated={bool(token)}) ...")
-AutoTokenizer.from_pretrained(model_id, token=token, clean_up_tokenization_spaces=False)
-AutoModelForCausalLM.from_pretrained(model_id, token=token, device_map="cpu")
-print("Done.")
-EOF
-
-RUN chown -R user:user /app/model_cache
-
+# HuggingFace Spaces runs as uid 1000
+RUN useradd -m -u 1000 user && chown -R user /app
 USER user
 
 EXPOSE 7860
 
-# python app.py — model loads at module level, then uvicorn starts in the same process
-# No forking, no workers — model is guaranteed loaded before first request
 CMD ["python", "app.py"]