Fix nutrition upload crash, persist runtime writes, serve API on its own domain

/api/upload/nutrition called json.dumps() in a module that never imported
json, so every request to it raised NameError, was swallowed by the broad
except, and came back as "500 Database import failed". Import json.

Persist the three directories the app writes to at runtime. Products added
through the UI are appended to data/seed_catalogs/*.json and retrained models
are written to app/intelligence/artifacts/*.joblib; both live inside the image,
so a redeploy silently discarded them. The paths now come from settings
(DATA_DIR / SEED_CATALOG_DIR / MODEL_ARTIFACTS_DIR) so a volume can be mounted
on them, and catalog_engine.save_catalog resolves against DATA_DIR instead of
a working-directory-relative "data/", which landed somewhere different
depending on where the process was started from.

Mounting those volumes would otherwise have made things worse: Docker seeds a
named volume from the image on first use, but a bind mount starts empty and
just hides what the image shipped. A bind mount on /app/data would have left
the API with no seed catalogs, so the next product added would write a JSON
file containing only that product. The image now keeps pristine copies at
/app/.bundled, and restore_bundled_assets() tops up whatever a freshly mounted
directory is missing at startup without overwriting anything already there.

Configure CORS for the split-domain deployment: the React app is served from
catalogue.nearle.ai.in and calls the API on mcp.catalogue.nearle.ai.in, so the
frontend origin has to be in API_CORS_ORIGINS. A wrong list fails only in the
browser while the server logs a healthy 200, so the effective origins are now
logged at startup with a warning when they are localhost-only.

Fix FRONTEND_DIST, which looked for a sibling "frontend/" directory that is
actually named "catalogue_frontend/", so the single-port unified-serving branch
could never activate even with a build sitting next to it.

Rebuild the Dockerfile on the frontend's multi-stage pattern: dependencies
resolve into a venv in a build stage, the runtime stage copies only that.
Adds PYTHONUNBUFFERED so startup errors reach Dokploy's log pane, a liveness
HEALTHCHECK (/api/health answers 200 even when Postgres is down, so a database
blip cannot restart-loop the container), and an overridable PORT. The CMD execs
uvicorn so SIGTERM reaches it rather than the sh wrapper.

Add "from __future__ import annotations" to ollama_service and image_search,
which used PEP 604 unions in runtime-evaluated signatures and so could not be
imported below Python 3.10.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.env.example

@@ -16,6 +16,51 @@
 # localhost URL points the backend at its own empty ports. Containers reach
 # each other by service name over the compose network instead.
 
+# --- Persistence (IMPORTANT in Docker) ------------------------------------
+# The three directories the app WRITES to at runtime. The defaults point inside
+# the repo/image and are right for local development; in a container each one
+# needs a volume mounted on it, or a redeploy throws away everything written
+# since the last build:
+#
+#   SEED_CATALOG_DIR     products added via POST /api/user/products/add and
+#                        /upload-file are appended to the JSON files here
+#   MODEL_ARTIFACTS_DIR  *.joblib bundles written by the training endpoints
+#   DATA_DIR             catalogs saved by the ingestion pipeline
+#
+# Mount these two paths in Dokploy (SEED_CATALOG_DIR sits inside DATA_DIR, so
+# one mount covers both):
+#
+#   /app/data
+#   /app/app/intelligence/artifacts
+#
+# Either a named volume or a bind mount works. The image keeps read-only copies
+# of the bundled seed catalogs and pre-trained models at /app/.bundled, and the
+# app restores whatever a freshly-mounted directory is missing on startup
+# without overwriting anything already there - so a bind mount, which starts
+# empty and would otherwise hide them, is safe.
+#
+# Leave all three unset unless the writable data belongs somewhere else.
+# DATA_DIR=/app/data
+# SEED_CATALOG_DIR=/app/data/seed_catalogs
+# MODEL_ARTIFACTS_DIR=/app/app/intelligence/artifacts
+
+# --- CORS (REQUIRED when the API is on its own domain) --------------------
+# Comma-separated list of the exact browser origins allowed to call this API.
+# Scheme and host both matter; no trailing slash, and no wildcard - the
+# frontend sends an Authorization header, and browsers refuse a credentialed
+# cross-origin request whose Allow-Origin is "*" (app/main.py logs and turns
+# credentials off if it sees one, so a wildcard silently breaks every call).
+#
+# Production - the React app is served from catalogue.nearle.ai.in and calls
+# the API at mcp.catalogue.nearle.ai.in, so that frontend origin must be listed:
+#
+#   API_CORS_ORIGINS=https://catalogue.nearle.ai.in
+#
+# Add http://localhost:5173 alongside it if you point a local Vite dev server
+# at the deployed API. Server-to-server callers (MCP clients, scripts) are not
+# affected by any of this - CORS is a browser rule; they use X-API-Key.
+API_CORS_ORIGINS=http://localhost:5173,http://127.0.0.1:5173
+
 # --- Authentication (REQUIRED) -------------------------------------------
 # The backend will not start without these while AUTH_ENABLED=true. Generate
 # all four lines, plus sign-in passwords, with: