refactor(docker): split requirements by role, slim enterprise bundle by default

Split requirements.txt into role-specific files:
  - requirements-backend.txt — FastAPI API runtime
  - requirements-agent.txt — Gradio/LangGraph agent (no embeddings)
  - requirements-embeddings.txt — opt-in sentence-transformers

Default enterprise bundle (./build.sh bundle) builds slim agent without
sentence-transformers/torch (~500 MB saved). Embeddings opt-in via
./build.sh bundle:embeddings <tag>. Embedding router degrades gracefully
when package is absent (ImportError catch in _embedding_router.py).

Updated Dockerfiles:
  - backend.Dockerfile → requirements-backend.txt
  - Dockerfile.agent → requirements-agent.txt + WITH_EMBEDDINGS build arg
  - all-in-one.Dockerfile → requirements-backend.txt

Added embeddings variant to build.sh with full manifest/digest output.
Hardened .dockerignore (cache, report, model, archive patterns).

Other branch work: align git route mocks with async services, remove
legacy agent test files superseded by contract tests.

backend/requirements.txt

@@ -1,75 +1,13 @@
-annotated-doc==0.0.4
-annotated-types==0.7.0
-anyio==4.12.0
-APScheduler==3.11.2
-attrs==25.4.0
-Authlib==1.6.6
-certifi==2025.11.12
-cffi==2.0.0
-charset-normalizer==3.4.4
-click==8.3.1
-cryptography==46.0.3
-fastapi==0.126.0
-greenlet==3.3.0
-h11==0.16.0
-httpcore==1.0.9
-httpx==0.28.1
-idna==3.11
-jaraco.classes==3.4.0
-jaraco.context==6.0.1
-jaraco.functools==4.3.0
-jeepney==0.9.0
-jsonschema==4.25.1
-jsonschema-specifications==2025.9.1
-keyring==25.7.0
-more-itertools==10.8.0
-pycparser==2.23
-pydantic>=2.7,<=2.12.3
-pydantic-settings
-pydantic_core==2.41.4
-python-multipart==0.0.21
-PyYAML==6.0.3
-passlib[bcrypt]
-python-jose[cryptography]
-PyJWT
-RapidFuzz==3.14.3
-referencing==0.37.0
-requests==2.32.5
-rpds-py==0.30.0
-SecretStorage==3.5.0
-alembic==1.18.4
-SQLAlchemy==2.0.45
-starlette==0.50.0
-typing-inspection==0.4.2
-typing_extensions==4.15.0
-tzlocal==5.3.1
-urllib3==2.6.2
-uvicorn==0.38.0
-websockets==15.0.1
-pandas
-psycopg2-binary
-openpyxl
-GitPython==3.1.44
-itsdangerous
-email-validator
-openai
-playwright
-tenacity
-Pillow
+# Full development requirements — aggregate of role-specific files.
+# For production Docker images, use the role-specific files:
+#   - requirements-backend.txt   (FastAPI backend)
+#   - requirements-agent.txt     (Gradio agent, no embedding)
+#   - requirements-embeddings.txt (optional semantic routing ML deps)
+
+-r requirements-backend.txt
+-r requirements-agent.txt
+-r requirements-embeddings.txt
+
+# Dev/test only — NOT included in any production image
 ruff>=0.11.0
-# Direct database drivers for DbExecutor (optional)
-asyncpg>=0.29.0
-clickhouse-connect>=0.7.0
-pymysql>=1.1.0
-sqlparse>=0.5.0
- lingua-language-detector>=2.2.0
 testcontainers[postgres]>=4.0
-aiofiles>=24.1.0
-aiosmtplib>=3.0.2
-gradio==5.50.0
-langgraph>=0.2
-langchain-core>=0.3
-langchain-openai>=0.3
-langgraph-checkpoint-postgres
-pdfplumber
-sentence-transformers>=3.0