Fix container scan vulnerabilities (#173)

[ritiksah141]

Summary

Remediates the fixable HIGH and CRITICAL vulnerabilities reported by the Trivy container scan. Closes #173 by removing the unused vulnerable Transformer stack, updating packaging tools, refreshing the base image, and preventing local development dependencies from entering the production image.

Before merging

No repository administrator action is required for this PR.

What changed

Python dependency remediation

• Removed the unused sentence-transformers dependency and its vulnerable transformers and PyTorch dependency chain.
• Kept the RAG pipeline on ChromaDB's default ONNX MiniLM embedding implementation.
• Removed the duplicate cryptography requirement.

Container hardening

• Moved the runtime image from python:3.11-slim-bookworm to python:3.11-slim-trixie.
• Pinned current versions of pip, setuptools, and wheel so vulnerable vendored copies of jaraco.context and wheel are replaced.
• Added .dockerignore rules that prevent virtual environments, Node dependencies, secrets, logs, caches, and local vector stores from entering the production image.

CI security gate

• Kept Trivy blocking on fixable HIGH and CRITICAL vulnerabilities.
• Configured the gate to ignore Debian advisories that do not have an available package fix.

Tests

• Added regression coverage proving the vulnerable Transformer packages are not direct requirements.
• Added coverage proving ChromaDB continues to select its ONNX MiniLM default embedding implementation.

Notes for reviewers

• The application does not import sentence-transformers or transformers. ChromaDB 0.4.24 supplies the default ONNX embedding implementation used by ai/embed.py and ai/retriever.py.
• Removing the unused Transformer stack avoids shipping unnecessary PyTorch and CUDA packages and removes CVE-2026-4372 rather than retaining it behind another transitive dependency.
• Trivy still evaluates the complete production image. The gate passes only when no fixable HIGH or CRITICAL findings remain.

Local verification

• ruff check .
• ruff format --check .
• Full backend suite in the clean image: 145 passed, 3 skipped, 48.98% coverage
• Production image build completed successfully.
• Trivy scan of the final image completed with 0 fixable HIGH or CRITICAL findings.
• Runtime verification confirmed transformers and sentence_transformers are absent.
• Runtime verification confirmed ChromaDB uses ONNXMiniLM_L6_V2.

Files to review

File	Why
Dockerfile	Updates the base image and packaging toolchain
requirements.txt	Removes the unused vulnerable dependency chain
.dockerignore	Prevents local development artifacts from entering the image
.github/workflows/ci.yml	Keeps the Trivy gate focused on fixable findings
tests/test_rag_dependencies.py	Adds dependency and RAG embedding regression coverage

[Vishnu2707]

Approved, address the vul.