chore(infra): wire MLflow/Airflow env vars, fix healthcheck, add .dockerignore

- docker-compose: pass ML_SERVING_URL, MLFLOW_URL, AIRFLOW_URL + creds to api service
- docker-compose: pass NEXT_PUBLIC_MLFLOW_URL/AIRFLOW_URL to admin service
- docker-compose: replace wget healthcheck with node fetch (wget not in node image)
- docker-compose: enable Airflow basic_auth API backend; add MLflow pip dep for DAGs
- Dockerfiles: tighten layer caching, add .dockerignore

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/docker/docker-compose.yml

@@ -11,12 +11,18 @@ services:
     env_file: ../../.env.local
     environment:
       NODE_ENV: production
+      ML_SERVING_URL: "http://ml-serving:8000"
+      MLFLOW_URL: "http://mlflow:5000"
+      AIRFLOW_URL: "http://airflow-webserver:8080"
+      AIRFLOW_API_USER: "admin"
+      AIRFLOW_API_PASSWORD: "${AIRFLOW_ADMIN_PASSWORD:-admin}"
+      INTERNAL_API_TOKEN: "${INTERNAL_API_TOKEN:-}"
     volumes:
       - /mnt/ssd/dbs/oo:/mnt/ssd/dbs/oo
     ports:
       - "127.0.0.1:3078:3078"
     healthcheck:
-      test: ["CMD", "wget", "--spider", "-q", "http://localhost:3078/health"]
+      test: ["CMD", "node", "-e", "fetch('http://localhost:3078/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -49,6 +55,8 @@ services:
       PORT: "3080"
       HOSTNAME: "0.0.0.0"
       NEXT_PUBLIC_API_URL: ""
+      NEXT_PUBLIC_MLFLOW_URL: "/mlflow"
+      NEXT_PUBLIC_AIRFLOW_URL: "/airflow"
       INTERNAL_API_URL: "http://api:3078"
     ports:
       - "127.0.0.1:3080:3080"
@@ -133,8 +141,14 @@ services:
       AIRFLOW__WEBSERVER__SECRET_KEY: ${AIRFLOW_SECRET_KEY:-change-me-in-prod}
       AIRFLOW__CORE__FERNET_KEY: ${AIRFLOW_FERNET_KEY:-}
       AIRFLOW__WEBSERVER__BASE_URL: ${AIRFLOW_BASE_URL:-https://o.alogins.net/airflow}
+      AIRFLOW__API__AUTH_BACKENDS: "airflow.api.auth.backend.basic_auth"
+      _PIP_ADDITIONAL_REQUIREMENTS: "mlflow==2.14.3 httpx"
+      MLFLOW_TRACKING_URI: "http://mlflow:5000/mlflow"
+      MLFLOW_TRACKING_USERNAME: "admin"
+      MLFLOW_TRACKING_PASSWORD: "${MLFLOW_ADMIN_PASSWORD:-password}"
     volumes:
       - ../../ml/pipelines:/opt/airflow/dags:ro
+      - ../../ml:/opt/airflow/ml:ro
     ports:
       - "127.0.0.1:8080:8080"
     depends_on:
@@ -155,8 +169,13 @@ services:
       AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: postgresql+psycopg2://airflow:${AIRFLOW_DB_PASSWORD:-airflow}@airflow-db/airflow
       AIRFLOW__CORE__EXECUTOR: LocalExecutor
       AIRFLOW__CORE__FERNET_KEY: ${AIRFLOW_FERNET_KEY:-}
+      _PIP_ADDITIONAL_REQUIREMENTS: "mlflow==2.14.3 httpx"
+      MLFLOW_TRACKING_URI: "http://mlflow:5000/mlflow"
+      MLFLOW_TRACKING_USERNAME: "admin"
+      MLFLOW_TRACKING_PASSWORD: "${MLFLOW_ADMIN_PASSWORD:-password}"
     volumes:
       - ../../ml/pipelines:/opt/airflow/dags:ro
+      - ../../ml:/opt/airflow/ml:ro
     depends_on:
       airflow-init:
         condition: service_completed_successfully