chore(reducer): dockerize for hugging face spaces deploy

Vercel functions can't reach the local FastAPI reducer, so package
services/reducer/ as a Docker Space image: uid-1000 user, port 7860,
pre-warmed MiniLM model baked into the image so cold starts return in
seconds. README carries the Space frontmatter and the env-var manifest
operators must set as Space secrets.

.dockerignore

@@ -0,0 +1,12 @@
+__pycache__/
+*.pyc
+*.pyo
+.pytest_cache/
+.ruff_cache/
+.venv/
+tests/
+samples/
+*.md
+!README.md
+.env
+.env.*

Dockerfile

@@ -0,0 +1,54 @@
+# VectorScape reducer — Hugging Face Spaces (Docker SDK) image.
+#
+# HF Spaces requirements baked in:
+#   - Runs as uid 1000 ("user"); $HOME must be writable.
+#   - App must bind to 0.0.0.0:7860.
+#   - sentence-transformers / huggingface caches live under $HOME and are
+#     populated at build time so the first request doesn't pay the model
+#     download cost (~90 MB for all-MiniLM-L6-v2).
+FROM python:3.11-slim
+
+# build-essential is kept because pacmap / hdbscan can fall back to a Cython
+# build when a manylinux wheel isn't published for the resolved version. git
+# is occasionally needed for pip VCS deps. Both can be dropped later if the
+# resolved lock turns out to be pure-wheel.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential \
+        git \
+    && rm -rf /var/lib/apt/lists/*
+
+# uv from the official static image — matches local toolchain.
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+RUN useradd -m -u 1000 user
+USER user
+
+ENV HOME=/home/user \
+    PATH=/home/user/.local/bin:$PATH \
+    HF_HOME=/home/user/.cache/huggingface \
+    TRANSFORMERS_CACHE=/home/user/.cache/huggingface \
+    SENTENCE_TRANSFORMERS_HOME=/home/user/.cache/huggingface \
+    REDUCER_CACHE_DIR=/home/user/.cache/vectorscape/embeddings \
+    UV_LINK_MODE=copy \
+    UV_PROJECT_ENVIRONMENT=/home/user/.venv \
+    PYTHONUNBUFFERED=1
+
+WORKDIR /home/user/app
+
+# Layer 1: install deps only (no project), so source edits don't bust this cache.
+COPY --chown=user:user pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project
+
+# Layer 2: pre-warm the local embedding model into the HF cache. First call to
+# /embed-reduce in production would otherwise pay a one-time ~90 MB download
+# AND torch warmup — both happen here instead, in the build.
+RUN uv run python -c "from sentence_transformers import SentenceTransformer; SentenceTransformer('all-MiniLM-L6-v2')"
+
+# Layer 3: source + install the project itself.
+COPY --chown=user:user app ./app
+COPY --chown=user:user reducer ./reducer
+RUN uv sync --frozen --no-dev
+
+EXPOSE 7860
+
+CMD ["uv", "run", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]

README.md

@@ -0,0 +1,45 @@
+---
+title: VectorScape Reducer
+emoji: 🌌
+colorFrom: indigo
+colorTo: purple
+sdk: docker
+app_port: 7860
+pinned: false
+short_description: Embeddings + dim reduction + clustering for VectorScape.
+---
+
+# VectorScape Reducer
+
+FastAPI service that turns text rows into 3D coordinates + clusters for the
+VectorScape web app. The web app calls this service over HTTPS with a shared
+secret in the `X-Reducer-Secret` header.
+
+## Endpoints
+
+- `GET /health` — liveness probe (unauthenticated).
+- `POST /embed-reduce` — embed → optional PCA → PaCMAP/UMAP → HDBSCAN, then
+  write `points` + `clusters` rows to Supabase. Requires `X-Reducer-Secret`.
+- `GET /status/{project_id}` — poll project status. Requires `X-Reducer-Secret`.
+- `POST /bridge` — explain the gap between two clusters via LLM. Requires
+  `X-Reducer-Secret`.
+
+## Required environment
+
+Set these as **secrets** in the Space settings (Settings → Variables and secrets):
+
+| Name | Purpose |
+| --- | --- |
+| `REDUCER_SHARED_SECRET` | Must match the value set on the web app. Auth fails closed if unset. |
+| `DATABASE_URL` | Supabase Postgres connection string (service-role; bypasses RLS). |
+| `OPENAI_API_KEY` | Optional. Only used when callers request `embed_model=openai` or for `/bridge`. |
+| `REDUCER_ASYNC_THRESHOLD` | Set to `999999` here — no Redis on this Space, so all jobs must run inline. |
+
+## Notes
+
+- The `all-MiniLM-L6-v2` model is pre-downloaded at image build time, so the
+  first request after a cold start doesn't pay the model download cost.
+- Inline-only on this Space (no arq worker, no Redis). Datasets above the
+  threshold will time out the HTTP request — small/demo CSVs only.
+- Source of truth: this directory is mirrored from the
+  [`vector-scape`](https://github.com/) monorepo's `services/reducer/`.