fix: add WORKDIR /app to runtime stage in Dockerfile

Runtime stage was missing WORKDIR, so uv run started from / and
couldn't find the .venv or pyproject.toml, causing "No module named
'winnow'" on container startup.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -68,6 +68,7 @@ RUN groupadd -g 568 apps && useradd -u 568 -g apps -m -s /bin/bash appuser \
     && mkdir -p /models/.insightface /models/huggingface \
     && chown -R appuser:apps /app /models
 
+WORKDIR /app
 USER appuser
 ENV HF_HOME=/models/huggingface INSIGHTFACE_HOME=/models