fix(docker): uv run senza sync nelle immagini server e client, cache uv dell'utente app (#39, #38)

Le immagini server e client non portano vendor/visionsuite: ogni uv run
rivalidava il progetto e falliva. UV_NO_SYNC=1 usa il venv di uv sync.
La cache uv creata da root in build va ceduta all'utente app.
Verificato con build e run delle due immagini.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Dockerfile.frontend

@@ -25,6 +25,10 @@ RUN useradd -m -u 10001 app
 # Independent of $HOME regardless: keeps the cache path explicit and writable
 # by the app user even if the home directory assumption ever changes.
 ENV UV_CACHE_DIR=/tmp/uv-cache
+# `uv run` must use the venv built by `uv sync` below as it is: re-validating
+# the project would look for vendor/visionsuite (the vision-worker extra), which
+# this image does not carry (issue 39). `uv sync` itself is not affected by it.
+ENV UV_NO_SYNC=1
 
 WORKDIR /app
 
@@ -41,7 +45,7 @@ COPY --from=tailwind-build /app/flask_app/static/css/tailwind.css ./flask_app/st
 # Compile Flask-Babel translation catalogs.
 WORKDIR /app/flask_app
 RUN uv run --project /app pybabel compile -d translations && \
-    chown -R app:app /app
+    chown -R app:app /app /tmp/uv-cache
 
 USER app