build: local stack, container images and the end-to-end smoke script

docker-compose brings up PostgreSQL 16 with pgvector and Redis 7 on
non-standard host ports so it never collides with an existing local database.
scripts/smoke.sh is the proof: compose, migrate, boot the API, issue a token,
call the real DeepSeek API and print the resulting ob_ai_call and bl_ledger
rows. services/vision and services/matting are placeholders noting that the
local RTX 5090 makes BiRefNet and RTMPose developable without cloud GPU.

deploy/Dockerfile.worker

@@ -0,0 +1,50 @@
+# syntax=docker/dockerfile:1
+# Celery worker image. Same build as the API; different entrypoint and queue set.
+# 架构文档 §14.1 runs worker-cpu / worker-io on CVM-app and worker-gpu on CVM-gpu,
+# so the queue list is injected rather than baked in.
+
+FROM python:3.12-slim AS builder
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+WORKDIR /app
+
+COPY pyproject.toml uv.lock* README.md ./
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-install-project --no-dev || uv sync --no-install-project --no-dev
+
+COPY apps ./apps
+COPY packages ./packages
+COPY services ./services
+COPY prompts ./prompts
+COPY migrations ./migrations
+COPY alembic.ini ./
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --no-dev --frozen || uv sync --no-dev
+
+
+FROM python:3.12-slim AS runtime
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PATH="/app/.venv/bin:$PATH" \
+    TZ=Asia/Shanghai \
+    CELERY_QUEUES=cpu,io \
+    CELERY_CONCURRENCY=4
+
+RUN groupadd --system meida && useradd --system --gid meida --home /app meida
+
+WORKDIR /app
+COPY --from=builder --chown=meida:meida /app /app
+
+USER meida
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
+    CMD celery -A apps.worker.celery_app.celery_app inspect ping -d "celery@$(hostname)" || exit 1
+
+CMD ["sh", "-c", "celery -A apps.worker.celery_app.celery_app worker -Q ${CELERY_QUEUES} -c ${CELERY_CONCURRENCY} -l info"]