feat(docker): add docker compose setup for api-tools

[torrid-fish]

目的

Provide a Docker-based workflow for running the API-tools Python service standalone, alongside the existing uv run flow, so contributors can spin it up with a single docker compose up.

方法／實作說明

新增 Docker 相關設定檔，並在 README 補上對應的執行說明與 .env.example 範本。額外從 feat/disable-auth（remote 分支已於 cherry-pick 後刪除）cherry-pick 兩個 commit — f3e708d → 36748e6（移除 auth middleware）與 ac5e346 → 7b8a0a6（移除 slowapi）— 把 API-tools 內既有的 X-API-KEY 驗證、CORS／TrustedHost／rate-limit middleware 全數移除，與上游 backend 端「停用驗證」的方向對齊；連帶把 .env.example 與 README 的 env 區塊收斂到實際還會被讀的兩個變數。

• Docker 設定：

  • Dockerfile: multi-stage build using python:3.11-slim + uv sync --frozen --no-dev, compiles .py → .pyc and drops sources in the runtime image
  • docker-compose.yml: single api-tools service, binds 127.0.0.1:${API_TOOLS_PORT:-8000}:8000, loads .env
  • .dockerignore: excludes git/venv/cache/deploy-only files from the build context
  • README.md: documents both the local uv run uvicorn workflow and the new docker compose up -d --build workflow

• 關鍵實作：

  • Builder stage uses uv sync --no-install-project so the venv layer is cached independently of source changes
  • Runtime image only copies .venv, compiled main.pyc, and the api/config packages — keeps the image lean
  • Port is bound to 127.0.0.1 only, matching the existing local-dev convention

• Auth／middleware 移除（cherry-picked from feat/disable-auth，原 remote 分支已刪除；本分支 commit 36748e6 + 7b8a0a6）：

  • main.py: 移除 APIKeyHeader（X-API-KEY）驗證、CORSMiddleware、TrustedHostMiddleware、SlowAPIMiddleware／Limiter 等所有 middleware 設定；五個 router (accent_marker、furigana_marker、usage_query、dict_query、sentence_query) 不再帶 Depends(get_api_key)
  • config/settings.py: 移除 X_API_KEY、ALLOW_ORIGINS、ALLOWED_HOSTS 三個 env 讀取與 assert，僅保留 YAHOO_API_KEY
  • pyproject.toml / uv.lock: 移除 slowapi（連帶 limits、deprecated、wrapt、packaging 等遞迴相依套件）
  • 影響：API-tools 現在直接以未驗證、未限流的方式對外提供服務；存取控制移交給上層 backend (CLIENT_API_KEY middleware) 以及 compose 預設 127.0.0.1 bind 把外網阻擋掉

• Docs／env 收斂：

  • .env.example: 只保留 YAHOO_API_KEY（app 啟動會 assert）與 API_TOOLS_PORT（compose host-side bind，預設 8000）；移除已不再被讀的 X_API_KEY／ALLOW_ORIGINS／ALLOWED_HOSTS
  • README.md: 同步 env 範例區塊，並補一行說明這個服務已不再做驗證／CORS／trusted-host，預期跑在 parent backend 後面或私網內

關聯 Issue

Refs sessatakuma/jpcorrect-backend#37 — parent-repo issue covering self-host on tuf + CD build. This PR provides the standalone Docker setup that the parent repo's deploy stack relies on. Closing happens from the parent repo's PR (sessatakuma/jpcorrect-backend#38), since GitHub does not auto-close cross-repo references.

附註

• The compose stack is intentionally scoped to API-tools only; the Go backend stack lives in the parent repo's compose.deploy.yml.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a Docker-based workflow for running the API-tools FastAPI service via docker compose, alongside the existing uv-based local run flow, with supporting docs and environment templates.

Changes:

• Introduces a multi-stage Dockerfile that installs deps via uv sync and runs uvicorn in a slim runtime image.
• Adds docker-compose.yml, .env.example, and .dockerignore to support one-command local startup.
• Updates README.md with standalone local-dev and Docker run instructions.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
README.md	Documents local uv workflow and new docker compose workflow.
Dockerfile	Adds multi-stage build for a slim runtime image using uv dependency sync.
docker-compose.yml	Adds a single api-tools service with .env loading and localhost-only port binding.
.env.example	Provides a template for required runtime environment variables.
.dockerignore	Reduces Docker build context by excluding VCS and local/dev artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[torrid-fish]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

🛡️ PR Quality Check Summary

✅ PR Title: Passed (Length: 52/75, Format: OK). feat(docker): add docker compose setup for api-tools
✅ Branch Name: Follows naming convention (feat/docker-compose)
✅ Commit Messages: All 7 commit(s) passed (Length, Format, Case)
✅ Conflicts: No merge conflict markers found
✅ Python Quality: All checks passed.

---

🎉 All checks passed!