Fix Docker layer caching in Dockerfile

[Copilot]

COPY . /app before dependency installation meant any source change invalidated the uv sync cache layer, forcing a full reinstall on every rebuild.

Changes

• Split the RUN step: system packages + uv install no longer chained with uv sync
• Copy only pyproject.toml and uv.lock before running uv sync --no-dev --frozen
• COPY . /app moved to after dependency installation

RUN apt-get update && apt-get install -y curl ca-certificates libmagic1 \
    && curl -LsSf https://astral.sh/uv/install.sh | sh \
    && apt-get clean && rm -rf /var/lib/apt/lists/*

COPY pyproject.toml uv.lock ./
RUN uv sync --no-dev --frozen

COPY . /app

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.