refactor(docker): split requirements by role, slim enterprise bundle by default

Split requirements.txt into role-specific files:
  - requirements-backend.txt — FastAPI API runtime
  - requirements-agent.txt — Gradio/LangGraph agent (no embeddings)
  - requirements-embeddings.txt — opt-in sentence-transformers

Default enterprise bundle (./build.sh bundle) builds slim agent without
sentence-transformers/torch (~500 MB saved). Embeddings opt-in via
./build.sh bundle:embeddings <tag>. Embedding router degrades gracefully
when package is absent (ImportError catch in _embedding_router.py).

Updated Dockerfiles:
  - backend.Dockerfile → requirements-backend.txt
  - Dockerfile.agent → requirements-agent.txt + WITH_EMBEDDINGS build arg
  - all-in-one.Dockerfile → requirements-backend.txt

Added embeddings variant to build.sh with full manifest/digest output.
Hardened .dockerignore (cache, report, model, archive patterns).

Other branch work: align git route mocks with async services, remove
legacy agent test files superseded by contract tests.

backend/requirements-agent.txt

@@ -0,0 +1,39 @@
+# Agent runtime: Gradio + LangGraph agent (no embedding model by default)
+anyio>=4.12.0
+certifi>=2025.11.12
+h11>=0.16.0
+httpcore>=1.0.9
+httpx>=0.28.1
+idna>=3.11
+sniffio>=1.3.0
+
+pydantic>=2.7,<3
+pydantic-settings
+pydantic_core>=2.41.0
+typing_extensions>=4.15.0
+
+# Gradio UI
+gradio>=5.50.0
+python-multipart>=0.0.21
+aiofiles>=24.1.0
+
+# LangChain agent framework
+langchain-core>=0.3
+langchain-openai>=0.3
+langgraph>=0.2
+langgraph-checkpoint-postgres
+
+# OpenAI SDK (explicit — needed by langchain-openai)
+openai>=1.0.0
+
+# Document parsing (uploaded files)
+pdfplumber
+openpyxl
+
+# DB for LangGraph checkpoint persistence (langgraph-checkpoint-postgres uses psycopg v3)
+psycopg2-binary
+psycopg>=3.1
+
+# Retry/utility
+tenacity>=8.0.0
+requests>=2.32.0