fix(docker): model downloads failed in containers (curl exit 23, glibc mismatch)

- pin builder and runtime to the same Debian release (trixie): the floating
  rust:1-slim builder drifted to a newer glibc than the bookworm runtime, so
  freshly built images crashed on start with 'GLIBC_2.39 not found'
- install curl in the runtime image — ready-.cmf imports download with it
- keep all gateway state under /app/data (CORTIQ_GATEWAY_HOME) and run as
  root so bind-mounted host folders on Docker Desktop are writable; pass
  --user 10001 to harden when not bind-mounting
- persist /app/data via a cortiq-data volume in docker-compose
- fail imports immediately with the path and reason when the models dir
  cannot be created, and annotate curl exit codes 23/22 with readable hints
- exclude local models/*.cmf from the docker build context

Dockerfile

@@ -1,5 +1,7 @@
 # ---- build stage ------------------------------------------------------------
-FROM rust:1-slim AS builder
+# pin builder and runtime to the same Debian release — a floating `rust:1-slim`
+# drifts to a newer glibc than the runtime image and the binary refuses to start
+FROM rust:1-slim-trixie AS builder
 WORKDIR /app
 # the admin SPA (web/) is embedded at compile time via rust-embed, so it must be present
 COPY Cargo.toml Cargo.lock ./
@@ -8,18 +10,24 @@ COPY web ./web
 RUN cargo build --release
 
 # ---- runtime stage ----------------------------------------------------------
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
+# curl is required at runtime — model imports download ready .cmf files with it
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates \
+    && apt-get install -y --no-install-recommends ca-certificates curl \
     && rm -rf /var/lib/apt/lists/* \
     && useradd -r -u 10001 cortiq \
-    && mkdir -p /app/config
+    && mkdir -p /app/config /app/data/models
 COPY --from=builder /app/target/release/cortiq-gateway /usr/local/bin/cortiq-gateway
 # ship the example as the default config so `docker run` works out of the box
 COPY config/gateway.example.toml /app/config/gateway.toml
 RUN chown -R 10001:10001 /app
 WORKDIR /app
-USER cortiq
+# all gateway state (downloaded models, stats, secrets) lives under /app/data —
+# mount a volume there to keep it across container recreates
+ENV CORTIQ_GATEWAY_HOME=/app/data
+# runs as root so writes to bind-mounted host folders (Docker Desktop on
+# Windows/macOS) don't fail with permission errors (curl exit code 23);
+# add `--user 10001` to docker run to harden when not using host bind mounts
 EXPOSE 9000
 ENTRYPOINT ["cortiq-gateway"]
 CMD ["--config", "/app/config/gateway.toml"]