Self-service /profile page (account info, icon/image avatar, sign out)
implementing the profile half of #553. Contributed by @IliaAvdeev.

Integration performed during merge onto current dev:
- Migrate ProfileLink and the profile page off the removed AUTH_ENABLED
  build-time export to runtime auth status (auth.ts was refactored on dev
  by #577). ProfileLink reads the full status via fetchAuthStatus (it needs
  username/avatar, which the useAuthStatus hook does not expose); the page
  gates on status.enabled.
- Resolve en/zh locale conflicts as a union of dev and PR keys.
- Honor EXIF orientation in createImageBitmap so the primary decode path
  matches the <img> fallback.
- Drop an unreachable AUTH_ENABLED render guard in the profile page.

Verified locally: tsc, eslint, ruff, web node tests (142), pytest
tests/multi_user (81 passed).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

#577 moved /api and /ws behind a request-time Next.js proxy (web/proxy.ts),
so the browser only talks to :3782 and the frontend forwards to the backend
server-side. Update the Docker quickstart accordingly:

- drop the :8001 host mapping from the default `docker run`; publishing it is
  now optional (direct API access only)
- replace the "map both ports / no in-container proxy" warning with the
  single-port reality
- rewrite the reverse-proxy guidance: single-container needs no API base (point
  the proxy at :3782); only split deployments set next_public_api_base, which is
  read server-side and never sent to the browser

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

fix: run supervisord as root so services start under rootful Docker

PR #577 dropped supervisord itself to UID 1000 via gosu; under a rootful
daemon (Docker Desktop / Docker Engine) the root-owned /dev/fd/1,2 and
pidfile become unopenable, so backend+frontend never spawn (EACCES). Run
supervisord as root and drop each child to deeptutor via per-program
user= instead — app processes stay non-root in both rootful Docker and
rootless podman.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ss keep-id

Removes `user=root` from the [supervisord] section in both production and
development supervisord configs, and rewrites the entrypoint comment to
explain why.

Background: under rootless podman + userns_mode: keep-id, container PID 1
runs as the host user (UID 1000) instead of root. The previous design
explicitly forced supervisord to drop privileges to root (`user=root`),
which works under rootful daemons (PID 1 is root, has CAP_SETUID) but
fails under rootless + keep-id — supervisord sees `user=root` in its
config, tries to setuid(0), lacks CAP_SETUID, and exits with
"Error: Can't drop privilege as nonroot user" (per supervisord
options.py: refuses to drop privileges when not running as root).

Fix: omit `user=` from the [supervisord] section so supervisord inherits
PID 1's UID (root in rootful; UID 1000 in rootless + keep-id). The
backend and frontend programs still drop to the unprivileged deeptutor
user via per-program `user=deeptutor` — setuid(1000) works because
either PID 1 is root (rootful) or PID 1 is already UID 1000 (rootless
keep-id, where the setuid is a no-op). /dev/fd/1,2 ownership matches
PID 1's UID in both runtimes, so supervisord's stdout/stderr writes
succeed without an explicit setuid dance.

Verified locally: clean heredoc indentation; supervisord config parses;
both [supervisord] sections confirmed without `user=root`.

Closes the rootless-podman + read-only-rootfs follow-up to PR #577
(reported by the user after #577 + #586 merged).

…e proxy

Harden the published image for rootless podman with a read-only rootfs, and
move URL/auth knowledge from build-time sed to a request-time proxy (web/proxy.ts).
Includes follow-up fixes: JSON-backed DEEPTUTOR_* env wiring for both Docker and
the PyPI launcher (correct auth.json key), runtime client auth resolution,
100MB-safe upload proxy buffer, updated tests, and corrected docs.

Closes HKUDS#576. Co-authored with @enihcam.

Self-service /profile page (account info, icon/image avatar, sign out)
implementing the profile half of HKUDS#553. Contributed by @IliaAvdeev.

Integration performed during merge onto current dev:
- Migrate ProfileLink and the profile page off the removed AUTH_ENABLED
  build-time export to runtime auth status (auth.ts was refactored on dev
  by HKUDS#577). ProfileLink reads the full status via fetchAuthStatus (it needs
  username/avatar, which the useAuthStatus hook does not expose); the page
  gates on status.enabled.
- Resolve en/zh locale conflicts as a union of dev and PR keys.
- Honor EXIF orientation in createImageBitmap so the primary decode path
  matches the <img> fallback.
- Drop an unreachable AUTH_ENABLED render guard in the profile page.

Verified locally: tsc, eslint, ruff, web node tests (142), pytest
tests/multi_user (81 passed).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

HKUDS#577 moved /api and /ws behind a request-time Next.js proxy (web/proxy.ts),
so the browser only talks to :3782 and the frontend forwards to the backend
server-side. Update the Docker quickstart accordingly:

- drop the :8001 host mapping from the default `docker run`; publishing it is
  now optional (direct API access only)
- replace the "map both ports / no in-container proxy" warning with the
  single-port reality
- rewrite the reverse-proxy guidance: single-container needs no API base (point
  the proxy at :3782); only split deployments set next_public_api_base, which is
  read server-side and never sent to the browser

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…visord

fix: run supervisord as root so services start under rootful Docker

PR HKUDS#577 dropped supervisord itself to UID 1000 via gosu; under a rootful
daemon (Docker Desktop / Docker Engine) the root-owned /dev/fd/1,2 and
pidfile become unopenable, so backend+frontend never spawn (EACCES). Run
supervisord as root and drop each child to deeptutor via per-program
user= instead — app processes stay non-root in both rootful Docker and
rootless podman.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ss keep-id

Removes `user=root` from the [supervisord] section in both production and
development supervisord configs, and rewrites the entrypoint comment to
explain why.

Background: under rootless podman + userns_mode: keep-id, container PID 1
runs as the host user (UID 1000) instead of root. The previous design
explicitly forced supervisord to drop privileges to root (`user=root`),
which works under rootful daemons (PID 1 is root, has CAP_SETUID) but
fails under rootless + keep-id — supervisord sees `user=root` in its
config, tries to setuid(0), lacks CAP_SETUID, and exits with
"Error: Can't drop privilege as nonroot user" (per supervisord
options.py: refuses to drop privileges when not running as root).

Fix: omit `user=` from the [supervisord] section so supervisord inherits
PID 1's UID (root in rootful; UID 1000 in rootless + keep-id). The
backend and frontend programs still drop to the unprivileged deeptutor
user via per-program `user=deeptutor` — setuid(1000) works because
either PID 1 is root (rootful) or PID 1 is already UID 1000 (rootless
keep-id, where the setuid is a no-op). /dev/fd/1,2 ownership matches
PID 1's UID in both runtimes, so supervisord's stdout/stderr writes
succeed without an explicit setuid dance.

Verified locally: clean heredoc indentation; supervisord config parses;
both [supervisord] sections confirmed without `user=root`.

Closes the rootless-podman + read-only-rootfs follow-up to PR HKUDS#577
(reported by the user after HKUDS#577 + HKUDS#586 merged).