Dockerize chat_backend + Ollama LAN + DB file storage (#6) (#7)

## Summary

Implements [chat_backend#6](#6) Part A:

- **uv** packaging (`pyproject.toml` + `uv.lock`), Docker/compose (dev + prod), entrypoint/validate-env, Gitea unit-test + auto-deploy workflows (mirror `scha`)
- Env-driven Django settings (`DJANGO_*`, `DATABASE_URL`, CSRF/CORS)
- **`OLLAMA_BASE_URL`** wired through all Ollama/LangChain clients (prod → `http://10.0.0.128:11434`)
- **DatabaseStorage** — prompt/document file blobs in Postgres (`StoredFile`), not container FS; RAG materializes temp paths for loaders
- ASGI via `gunicorn` + `UvicornWorker` (HTTP + WebSockets)

Companion server-infra PR registers `app_catalog` / `host_apps` (port **8003**).

## Test plan

- [ ] `uv sync && cd llm_be && SKIP_RAG_INIT=1 uv run python manage.py test`
- [ ] `docker compose build && docker compose up` against bundled Postgres
- [ ] Confirm Ollama calls use `OLLAMA_BASE_URL` (not hardcoded localhost)
- [ ] Upload a document / prompt file → row in `chat_backend_storedfile`, no disk under `media/`
- [ ] After server-infra merge + secret/Postgres/NPM: deploy via `deploy.sh --app chat_backend --env prod`Reviewed-on: #7

scripts/docker-entrypoint.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd /app/llm_be
+
+wait_for_database() {
+  if [[ -z "${DATABASE_URL:-}" && -z "${DB_HOST:-}" ]]; then
+    return 0
+  fi
+
+  echo "Waiting for database..."
+  for _ in $(seq 1 30); do
+    if SKIP_RAG_INIT=1 uv run python - <<'PY'
+import os
+import sys
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "llm_be.settings")
+os.environ["SKIP_RAG_INIT"] = "1"
+
+import django
+from django.db import connections
+from django.db.utils import OperationalError
+
+django.setup()
+
+try:
+    connections["default"].ensure_connection()
+except OperationalError:
+    sys.exit(1)
+PY
+    then
+      echo "Database is ready."
+      return 0
+    fi
+    sleep 2
+  done
+
+  echo "Database did not become ready in time." >&2
+  exit 1
+}
+
+wait_for_database
+
+# ASGI (HTTP + WebSockets). UvicornWorker required for channels.
+export SKIP_RAG_INIT=1
+uv run python manage.py migrate --noinput
+uv run python manage.py collectstatic --noinput
+unset SKIP_RAG_INIT
+
+exec uv run gunicorn llm_be.asgi:application \
+  -k uvicorn.workers.UvicornWorker \
+  --bind "${GUNICORN_BIND:-0.0.0.0:8000}" \
+  --workers "${GUNICORN_WORKERS:-2}"

scripts/validate-env.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ENV_FILE="${1:?Usage: $0 <env-file>}"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "Environment file not found: $ENV_FILE" >&2
+  exit 1
+fi
+
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+DJANGO_ENV="${DJANGO_ENV:-prod}"
+
+required_vars=(
+  DJANGO_SECRET_KEY
+  DJANGO_ALLOWED_HOSTS
+  DATABASE_URL
+  WEB_PORT
+  OLLAMA_BASE_URL
+)
+
+if [[ "$DJANGO_ENV" == "prod" || "$DJANGO_ENV" == "beta" ]]; then
+  required_vars+=(
+    EMAIL_HOST_USER
+    EMAIL_HOST_PASSWORD
+  )
+fi
+
+missing=()
+for var in "${required_vars[@]}"; do
+  if [[ -z "${!var:-}" ]]; then
+    missing+=("$var")
+  fi
+done
+
+if ((${#missing[@]} > 0)); then
+  echo "Missing required environment variables in $ENV_FILE:" >&2
+  printf '  - %s\n' "${missing[@]}" >&2
+  echo "Copy .env.prod.example to ~/Documents/secrets/chat_backend/chat_backend_${DJANGO_ENV}.env and set production values." >&2
+  exit 1
+fi
+
+if [[ "$DJANGO_ENV" == "prod" && ( "$DJANGO_SECRET_KEY" == change-me* || "$DJANGO_SECRET_KEY" == *dev-only* ) ]]; then
+  echo "DJANGO_SECRET_KEY must be changed from the example value for production." >&2
+  exit 1
+fi
+
+echo "Environment validation passed (DJANGO_ENV=$DJANGO_ENV)."