Finalize deployment consistency and clean-user E2E validation

[taha328]

Summary

Align final deployment configuration, consolidate runtime threshold source of truth, and validate the authorized clean-client CPU Docker flow.

Fixes

• Default root and client PostGIS to imresamu/postgis:16-3.4.
• Expose and inject canonical threshold env variables.
• Remove active legacy threshold settings and stale model artifact references.
• Align deployment backend image reference to cpu-v0.1.2.

Threshold source of truth

APP_CHANGE_THRESHOLD and APP_SEMANTIC_THRESHOLD are the only runtime sources. Request fields remain accepted but cannot override settings. Clean-client inference proved manifest and run response values of 0.35 and 0.50 with source backend_settings_env.

Release/tag strategy

Use immutable v0.1.2 after merge because tracked backend/deployment files changed after v0.1.1. Continue using the authorized v0.1.1 model release asset. No tag or release was created before merge.

Clean-user Docker validation

• Clean clone branch checkout completed.
• Local fallback model artifact installed with checksum verification.
• PostGIS, Redis, backend API, Celery worker, and frontend became healthy on native linux/arm64.
• MODEL_DEVICE=auto resolved to CPU with PyTorch 2.12.0+cpu.

Real pipeline validation

Real BANDON Docker inference completed. Final rerun: job job-e659a64fe6d748e0ac56347d8359aada, request hash 5ca577a5ad01eb19f8bc97ea, 14 artifacts, and PNG retrieval passed. Browser validation confirmed the deployed frontend and map render.

Tests

• Focused backend: 26 passed.
• Full backend: 474 passed, 5 skipped, 7 unrelated existing failures.
• Frontend original worktree: 69 tests passed and build passed.
• Clean clone frontend: 55 tests passed; build unavailable because clean client intentionally had no Node dependencies.
• Root/deploy compose resolution, runtime validation, health checks, and real smoke inference passed.

Known limitations

• GHCR publish of cpu-v0.1.2 is blocked because the available GitHub token lacks package write scope; E2E used the exact locally loaded arm64 image. The remote tag does not exist yet.
• A repeat start.sh after backend environment changes can leave the existing frontend proxy pointing at the old backend container until frontend recreation.
• CUDA remains optional and pending production validation; no CUDA readiness claim is made.
• Phase 4G remains incomplete until cpu-v0.1.2 is published and a clean pull-only validation passes.