…brid retrieval

QueryFusionRetriever asks BM25 for top_k x bm25_multiplier candidates; on a
knowledge base with fewer nodes than that (e.g. a single short document),
newer llama-index-retrievers-bm25 raises "k of N is larger than the number of
available scores" at query time instead of returning what it has. Clamp the
BM25 retriever's similarity_top_k to the docstore node count.

This was latent — the BM25 path is skipped when the optional package is absent
(as in the local dev env) — and was surfaced by the new FAISS end-to-end test
(1-node corpus), which failed CI on the v1.4.12 commit across Python 3.11-3.14.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ss keep-id

Removes `user=root` from the [supervisord] section in both production and
development supervisord configs, and rewrites the entrypoint comment to
explain why.

Background: under rootless podman + userns_mode: keep-id, container PID 1
runs as the host user (UID 1000) instead of root. The previous design
explicitly forced supervisord to drop privileges to root (`user=root`),
which works under rootful daemons (PID 1 is root, has CAP_SETUID) but
fails under rootless + keep-id — supervisord sees `user=root` in its
config, tries to setuid(0), lacks CAP_SETUID, and exits with
"Error: Can't drop privilege as nonroot user" (per supervisord
options.py: refuses to drop privileges when not running as root).

Fix: omit `user=` from the [supervisord] section so supervisord inherits
PID 1's UID (root in rootful; UID 1000 in rootless + keep-id). The
backend and frontend programs still drop to the unprivileged deeptutor
user via per-program `user=deeptutor` — setuid(1000) works because
either PID 1 is root (rootful) or PID 1 is already UID 1000 (rootless
keep-id, where the setuid is a no-op). /dev/fd/1,2 ownership matches
PID 1's UID in both runtimes, so supervisord's stdout/stderr writes
succeed without an explicit setuid dance.

Verified locally: clean heredoc indentation; supervisord config parses;
both [supervisord] sections confirmed without `user=root`.

Closes the rootless-podman + read-only-rootfs follow-up to PR #577
(reported by the user after #577 + #586 merged).

fix(docker): make supervisord config portable across rootful + rootless keep-id

Refresh the standalone technical poster (HTML + rendered PNG). Artifact
only — unrelated to release content.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Partners with non-Latin names create correctly and become assignable to
specific users; logos render after login in multi-user mode (#599); small
knowledge bases retrieve reliably; and containers start cleanly under
rootless Podman. Drop-in — no migrations.

- Partners: slugify keeps Unicode letters so Chinese (and other non-Latin)
  names no longer collapse to an empty id; partners become a grantable
  resource (admin assigns; assignee can connect + consult; CRUD stays
  admin-only) via new partner_access.py + /subagents/partners endpoint.
- Multi-user: public static assets bypass the auth gate so the Next.js image
  optimizer's cookie-less loopback fetch no longer 307s to /login and breaks
  logos/banners (#599); routing policy extracted to a pure, tested proxy-policy.ts.
- RAG: BM25 top_k clamped to corpus size so a tiny KB no longer crashes
  hybrid retrieval at query time.
- Uploads: one 200MB limit for every format (dropped the separate PDF cap);
  proxy body limit raised to match.
- Docker: supervisord runs as PID 1's UID with its pidfile in /tmp, portable
  across rootful Docker and rootless podman keep-id.
- Release notes (ver1-4-13.md), version bump to 1.4.13, README prose +
  Releases row, and all 10 translated READMEs synced.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>