feat(docker): optimize image size via multi-stage Bookworm build

[abstract-333]

Summary

This PR optimizes the Docker configuration for the apod-api. It introduces a multi-stage build process and standardizes the base image to Debian Bookworm, reducing the final image size by 55%.

🛠 Key Changes

1. Base Image Standardization (Bookworm-slim)

I have transitioned the base image from Debian Trixie to python:3.12.10-slim-bookworm.

• Reasoning: The project specifies a requirement for Python 3.12.10. While the previous environment used 3.12.12 on Trixie, the official 3.12.10 images are built on Bookworm (Debian Stable).
• Stability: Moving to Bookworm ensures we are using a stable release rather than a testing branch (Trixie), ensuring reliable glibc compatibility for image-processing libraries like Pillow.

2. Multi-Stage Build Implementation

Implemented a two-stage build process to separate the "Builder" environment from the "Runtime" environment:

• Stage 1 (Builder): Installs uv and compiles the virtual environment. It utilizes Docker cache mounts and bind mounts to speed up dependency installation without bloating the image.
• Stage 2 (Runtime): Copies only the necessary application code and the pre-built .venv. This strips away build tools, uv binaries, and package caches.

3. Security Hardening

• Non-root User: Implemented a non-privileged user (nonroot) with UID 1000 to run the application.
• Reference: This implementation was adapted and modernized from the security patterns suggested in Fix logic bug in concept tagging and harden Dockerfile security #146.

📊 Metrics & Comparison

Metric	Previous (Trixie)	New (Bookworm Multi-Stage)	Change
Image Size	351 MB	158 MB	-193 MB (55%)
Python Version	3.12.12	3.12.10	Aligned to Req
OS Environment	Trixie (Testing)	Bookworm (Stable)	Standardized
User Privileges	root	nonroot	Hardened

✅ Validation

• Build: Successfully built using specific SHA256 digests for deterministic results.
• Compatibility: Verified that Pillow, Flask, and Gunicorn function correctly on the Bookworm base.
• Runtime: Confirmed the API responds on port 5000 and verified non-root file permissions.