Code sync, security fixes

Dockerfile

@@ -0,0 +1,67 @@
+# Relata production image.
+#
+# Multi-stage: a full toolchain builds a static binary, and the runtime stage
+# contains that binary, CA certificates and nothing else. There is no shell and
+# no package manager in the final image, so a compromised process has very
+# little to work with.
+
+# --- Build stage -----------------------------------------------------------
+
+FROM golang:1.26.5-alpine AS build
+
+# git is needed only if a dependency resolves via VCS; ca-certificates lets the
+# module proxy be reached over TLS.
+RUN apk add --no-cache git ca-certificates tzdata
+
+WORKDIR /src
+
+# Dependencies are copied and downloaded first so that a source-only change
+# does not invalidate the module cache layer.
+COPY go.mod go.sum ./
+RUN go mod download && go mod verify
+
+COPY . .
+
+ARG VERSION=dev
+ARG TARGETARCH
+
+# CGO is disabled so the result is a genuinely static binary that runs on
+# scratch. Symbols and DWARF are stripped; the build is reproducible given the
+# same inputs (-trimpath removes local filesystem paths).
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} \
+    go build \
+      -trimpath \
+      -ldflags="-s -w -X main.version=${VERSION}" \
+      -o /out/relata \
+      ./cmd/relata
+
+# Confirm the binary is static and runnable before it reaches the runtime stage.
+RUN /out/relata version
+
+# --- Runtime stage ---------------------------------------------------------
+
+FROM scratch
+
+# Certificates for outbound TLS (a remote Qdrant or an OpenAI-compatible
+# provider), and zone data so timestamps format correctly.
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=build /usr/share/zoneinfo /usr/share/zoneinfo
+
+COPY --from=build /out/relata /usr/local/bin/relata
+
+# A fixed non-root UID/GID. There is no /etc/passwd in a scratch image, so the
+# numeric form is used; the upload volume must be writable by this UID.
+USER 65532:65532
+
+# The upload directory is the only path Relata writes to. It is declared as a
+# volume so that the root filesystem can be mounted read-only.
+VOLUME ["/data/uploads"]
+
+ENV RELATA_UPLOAD_DIR=/data/uploads \
+    RELATA_HTTP_ADDR=0.0.0.0:8080 \
+    RELATA_LOG_JSON=true
+
+EXPOSE 8080
+
+ENTRYPOINT ["/usr/local/bin/relata"]
+CMD ["serve"]