Update Dockerfile for Hugging Face Spaces

Dockerfile

@@ -19,13 +19,22 @@ COPY requirements.txt .
 # Added default-timeout to prevent "ReadTimeoutError" on slow connections
 RUN pip install --default-timeout=1000 --no-cache-dir -r requirements.txt
 
+# 5b. HF SPACES: Create a non-root user
+RUN useradd -m -u 1000 user
+
 # 6. Copy the rest of your code
-COPY . .
+COPY --chown=user . .
 
 # 7. Run the seed script to "bake" the AI models into the image
+# We run as root first to ensure permissions, or we can run as user if pip installed locally.
+# However, usually pip installs are global here. Let's switch to user.
+USER user
+
+# Pre-load/Seed models (as user 1000 to avoid permission issues)
 RUN python seed_references.py
 
 # 8. Start the app (The Critical Fix)
-# We use "sh -c" so we can read the ${PORT} variable from Render.
-# If Render gives a port (usually 10000), we use it. If not, we use 8000.
-CMD ["sh", "-c", "uvicorn app:app --host 0.0.0.0 --port ${PORT:-8000}"]
+# We use "sh -c" so we can read the ${PORT} variable from Render/HF.
+# Spaces uses 7860 by default.
+ENV PORT=7860
+CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]