Harden CPU AI image builds

deploy/unraid/Dockerfile.all-in-one

@@ -9,6 +9,9 @@ RUN npm run build
 FROM postgres:16-bookworm AS runtime
 
 ARG GEOINTEL_INSTALL_AI=false
+ARG GEOINTEL_TORCH_INDEX_URL=https://download.pytorch.org/whl/cpu
+ARG GEOINTEL_TORCH_VERSION=2.13.0
+ARG GEOINTEL_TORCHVISION_VERSION=0.28.0
 
 ENV GEOINTEL_ENV=production \
     GEOINTEL_API_PREFIX=/api/v1 \
@@ -44,15 +47,25 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
-COPY backend/ /app/
-COPY fixtures/ /app/fixtures/
+COPY backend/pyproject.toml backend/README.md /app/
+COPY backend/app/__init__.py /app/app/__init__.py
 
 RUN /usr/bin/python3.11 -m venv /opt/geointel/venv \
     && pip install --no-cache-dir --upgrade pip setuptools \
+    && if [ "$GEOINTEL_INSTALL_AI" = "true" ]; then \
+         pip install --no-cache-dir \
+           --index-url "$GEOINTEL_TORCH_INDEX_URL" \
+           "torch==$GEOINTEL_TORCH_VERSION" \
+           "torchvision==$GEOINTEL_TORCHVISION_VERSION"; \
+       fi \
     && extras=".[gis]" \
     && if [ "$GEOINTEL_INSTALL_AI" = "true" ]; then extras=".[gis,ai]"; fi \
-    && pip install --no-cache-dir "$extras" \
-    && python scripts/gis_import_smoke.py \
+    && pip install --no-cache-dir "$extras"
+
+COPY backend/ /app/
+COPY fixtures/ /app/fixtures/
+
+RUN python scripts/gis_import_smoke.py \
     && python scripts/yolo_preflight.py --json >/tmp/geointel-yolo-preflight.json \
     && rm -f /etc/nginx/sites-enabled/default \
     && mkdir -p /app/storage /run/nginx /var/log/nginx

deploy/unraid/README.md

@@ -96,6 +96,11 @@ GIS-only image. Set `GEOINTEL_INSTALL_AI=true`, mount models through
 when you have a local model file.
 The AI-enabled image installs PyTorch/Ultralytics plus the native OpenCV runtime
 libraries needed for Ultralytics imports; it still never downloads model weights.
+The documented CPU runtime installs pinned `torch==2.13.0` and
+`torchvision==0.28.0` from `https://download.pytorch.org/whl/cpu`, avoiding the
+unused CUDA runtime wheels included by the general Linux package index. The
+Dockerfile copies dependency metadata before backend source, so normal code-only
+redeploys can reuse the expensive dependency layer.
 `YOLO_CONFIG_DIR` defaults to `/app/storage/ultralytics`, a writable persistent
 path, so Ultralytics settings do not fall back to root user config directories.