fix: resolve remaining docker runtime issues

- docker-compose.yml: remove internal:true from network (blocked HuggingFace
  model downloads); postgres stays protected by not exposing its port
- docker-compose.yml: fix embedding defaults (bge-m3, cpu fallback)
- docker-compose.yml: remove mandatory GPU reservation from base compose;
  GPU is opt-in via docker-compose.override.yml for systems with NVIDIA runtime
- docker/watcher+mcp: pin transformers<4.49 to avoid Python 3.10 incompatibility
  (nn.Module used in type annotation without import in transformers>=4.49)
- docker-compose.override.yml.example: GPU deploy blocks documented as opt-in

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

docker-compose.yml

@@ -7,8 +7,8 @@ x-pg-env: &pg-env
   POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
 
 x-embedding-env: &embedding-env
-  EMBEDDING_MODEL: ${EMBEDDING_MODEL:-BAAI/bge-large-en-v1.5}
-  EMBEDDING_DEVICE: ${EMBEDDING_DEVICE:-cuda}
+  EMBEDDING_MODEL: ${EMBEDDING_MODEL:-BAAI/bge-m3}
+  EMBEDDING_DEVICE: ${EMBEDDING_DEVICE:-cpu}
   EMBEDDING_BATCH_SIZE: ${EMBEDDING_BATCH_SIZE:-32}
 
 # ─── Services ─────────────────────────────────────────────────────────────────
@@ -48,13 +48,6 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
-    deploy:
-      resources:
-        reservations:
-          devices:
-            - driver: nvidia
-              count: 1
-              capabilities: [gpu]
     networks:
       - internal
 
@@ -75,13 +68,6 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
-    deploy:
-      resources:
-        reservations:
-          devices:
-            - driver: nvidia
-              count: 1
-              capabilities: [gpu]
     networks:
       - internal
       - external
@@ -93,7 +79,5 @@ volumes:
 
 # ─── Networks ─────────────────────────────────────────────────────────────────
 networks:
-  internal:
-    internal: true   # no external access
-  external:
-    {}               # mcp is reachable from the host
+  internal: {}       # shared backend network; postgres port not exposed to host
+  external: {}       # mcp is reachable from the host

pyproject.toml

@@ -18,13 +18,15 @@ dependencies = [
 [project.optional-dependencies]
 watcher = [
     "watchdog>=4.0",
-    "sentence-transformers>=3.0",
+    "sentence-transformers>=3.0,<4.0",
+    "transformers>=4.40,<4.49",
     "torch>=2.3",
     "mistune>=3.0",
 ]
 mcp = [
     "mcp[cli]>=1.2",
-    "sentence-transformers>=3.0",
+    "sentence-transformers>=3.0,<4.0",
+    "transformers>=4.40,<4.49",
     "torch>=2.3",
     "uvicorn[standard]>=0.29",
     "starlette>=0.37",