feat: harden intelligence runtime and llm providers

Dockerfile

@@ -4,16 +4,21 @@ WORKDIR /app
 
 # Copy package files first for better layer caching
 COPY package*.json ./
-RUN npm install --production
+RUN npm ci --omit=dev
 
 # Copy source
 COPY . .
+RUN mkdir -p /app/runs /app/runs/memory /app/runs/memory/cold && chown -R node:node /app
 
 # Default port (override with -e PORT=xxxx)
 EXPOSE 3117
+ENV PORT=3117 \
+    AUTO_OPEN_BROWSER=false \
+    NODE_ENV=production
 
 # Health check
-HEALTHCHECK --interval=60s --timeout=10s --retries=3 \
-  CMD wget -qO- http://localhost:3117/api/health || exit 1
+HEALTHCHECK --interval=60s --timeout=10s --start-period=45s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3117)+'/api/health').then(r=>{if(![200,503].includes(r.status))process.exit(1);return r.json()}).then(j=>{if(['error'].includes(j.status))process.exit(1)}).catch(()=>process.exit(1))"
 
+USER node
 CMD ["node", "server.mjs"]