feat(mimir-inbox): book-ingestion UI stack on corviduo-dev:8091 (#377)

WG-internal FastAPI+HTMX front end for large-document ingestion into the
Muninn KB, over the muninn-gate API (browser -> mimir-inbox -> staging ->
path-addressed POST /jobs). Co-located on corviduo-dev with the gate (:8090)
and the worldtree-personal muninn watcher per the operator's 2026-08-01
co-location ruling (reversing the earlier off-box/NFS plan; worldtree-dev
approved the box placement).

- Dockerfile: python:3.11-slim + uv sync --no-dev --frozen (--no-dev is
  load-bearing; the dev group's muninn-dispatch path source is absent in-image
  and INV-MI-7 forbids importing it). Single-stage by design — src/ stays in
  the final image (uv installs the project editable-linked to src/).
- compose.yaml: uid 1000, host-net bind 10.250.50.152:8091, staging :rw,
  TCP-liveness healthcheck (deliberately not coupled to gate reachability).
- Built from vh/mimir-inbox HEAD c8ab38f; deployed + healthy.

Records the open-in-place claim semantics (worldtree-dev, runner.py:362-367)
and the INV-MI-19 retention rule (staged files persist until job terminal;
gate retry returns a false-200 on a swept source) in persistent memory.

stacks/mimir-inbox/Dockerfile

@@ -0,0 +1,37 @@
+# mimir-inbox — UI front end for large-document / book ingestion into the Muninn
+# KB, over the muninn-gate API (browser -> mimir-inbox -> staging -> path-addressed
+# POST /jobs to the gate; bytes never reach the gate). No Dockerfile upstream
+# (vh/mimir-inbox); this is infra-ops's, modeled on the muninn-gate one.
+#
+# All 7 RUNTIME deps are public PyPI — NO private index, NO BuildKit secret
+# (unlike muninn-gate, which needed muninn-dispatch at runtime).
+#
+#   docker build -t mimir-inbox:0.0.1 .
+FROM python:3.11-slim
+
+RUN pip install --no-cache-dir uv==0.11.*
+
+WORKDIR /app
+COPY pyproject.toml uv.lock README.md ./
+COPY src ./src
+
+# Install project + deps from the lockfile, EXCLUDING the dev group. --no-dev is
+# load-bearing, not just leaner: the dev group carries muninn-dispatch via a path
+# source ("../Worldtree/packages/muninn-dispatch") that is absent in the image,
+# AND INV-MI-7 asserts runtime code never imports muninn_dispatch. Runtime deps
+# resolve entirely from PyPI.
+RUN uv sync --no-dev --frozen --no-cache
+
+# SINGLE-STAGE BY DESIGN — DO NOT convert to multi-stage that copies only .venv.
+# `uv sync` installs the project EDITABLE-linked back to /app/src/mimir_inbox (not
+# copied into site-packages), so mimir_inbox.__file__ — and the 16 templates + 442
+# static assets (vendored design CSS + htmx) it serves from — resolve out of src/.
+# Dropping src/ in a final layer would kill the app at import; if it somehow got
+# past import it would 404 every asset. src/ MUST remain alongside .venv.
+# (mimir-dev preflight, 2026-08-01: `uv sync --no-dev --frozen` boots green with
+# the path source absent; the alternative safe shape is `uv build --wheel` +
+# install the wheel, which copies assets into site-packages.)
+ENV PATH="/app/.venv/bin:$PATH"
+
+# The launcher (compose) owns --host/--port; no CMD here. Runs as uid 1000 (set
+# in compose) — the sole writer to the staging root; /app is read-only to it.