Prepare GeoIntel for public release

deploy/unraid/Dockerfile.all-in-one

@@ -1,4 +1,4 @@
-FROM node:20-alpine AS frontend-build
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS frontend-build
 
 WORKDIR /frontend
 COPY frontend/package.json frontend/package-lock.json ./
@@ -6,15 +6,10 @@ RUN npm ci
 COPY frontend/ ./
 RUN npm run build
 
-FROM postgres:16-bookworm AS runtime
+FROM postgres:16-bookworm@sha256:bb3e1a57e5407e0a5280b4211980a5e537f4abd234a87014ac979849a78dd825 AS runtime
 
 ARG GEOINTEL_INSTALL_AI=false
 ARG GEOINTEL_TORCH_INDEX_URL=https://download.pytorch.org/whl/cu128
-ARG GEOINTEL_TORCH_VERSION=2.11.0
-ARG GEOINTEL_TORCHVISION_VERSION=0.26.0
-ARG GEOINTEL_ULTRALYTICS_VERSION=8.4.99
-ARG GEOINTEL_SETUPTOOLS_VERSION=81.0.0
-ARG GEOINTEL_WHEEL_VERSION=0.47.0
 
 ENV GEOINTEL_ENV=production \
     GEOINTEL_API_PREFIX=/api/v1 \
@@ -53,22 +48,20 @@ WORKDIR /app
 COPY deploy/unraid/gosu-setpriv /usr/local/bin/gosu
 COPY backend/pyproject.toml /app/
 COPY backend/requirements-runtime.lock /app/
+COPY backend/requirements-ai-linux.lock /app/
+COPY backend/requirements-build-tools.lock /app/
 COPY backend/app/__init__.py /app/app/__init__.py
 
 RUN printf '# GeoIntel backend package metadata\n' > /app/README.md \
     && /usr/bin/python3.11 -m venv /opt/geointel/venv \
     && pip install --no-cache-dir --require-hashes -r requirements-runtime.lock \
     && if [ "$GEOINTEL_INSTALL_AI" = "true" ]; then \
-         pip install --no-cache-dir \
-           --index-url "$GEOINTEL_TORCH_INDEX_URL" \
-           "torch==$GEOINTEL_TORCH_VERSION" \
-           "torchvision==$GEOINTEL_TORCHVISION_VERSION" \
-         && pip install --no-cache-dir \
-           "ultralytics==$GEOINTEL_ULTRALYTICS_VERSION"; \
+         pip install --no-cache-dir --require-hashes \
+           --index-url https://pypi.org/simple \
+           --extra-index-url "$GEOINTEL_TORCH_INDEX_URL" \
+           -r requirements-ai-linux.lock; \
        fi \
-    && pip install --no-cache-dir \
-      "setuptools==$GEOINTEL_SETUPTOOLS_VERSION" \
-      "wheel==$GEOINTEL_WHEEL_VERSION" \
+    && pip install --no-cache-dir --require-hashes -r requirements-build-tools.lock \
     && pip check
 
 COPY backend/ /app/

deploy/unraid/MANUAL_DEPLOY.md

@@ -178,7 +178,7 @@ docker logs --tail 200 geointel
 
 De vroegere geneste mirror `C:\Projects\geointel\geointel` is geretireerd. De
 immutable Git-herkomst, niet-getrackte recoverybestanden en verificatiegrens
-staan in `docs/accuracy-program/13-nested-mirror-retirement.md`. Behandel die
+staan in de private release-evidence buiten Git. Behandel die
 evidence als herstelreferentie; deze handleiding vraagt geen extra kopieer- of
 opruimactie.