fix: Correct frontend ports and prevent internet pulls in offline mode

This commit fixes critical deployment issues across production and offline configurations:

## Production (docker-compose.prod.yml)
1. **Frontend Port Fix**:
   - Change port mapping from 5173:80 to 5173:8080
   - Update healthcheck to use port 8080 instead of 80
   - Matches actual nginx configuration listening on port 8080
   - **Fixes**: Frontend unhealthy, app not loading in browser

2. **Environment Variables**:
   - Add MODELS_DIRECTORY to backend and celery-worker
   - Ensures consistency with main docker-compose.yml

## Offline (docker-compose.offline.yml)
1. **Prevent Internet Access**:
   - Add `pull_policy: never` to ALL services (7 services total)
   - postgres, minio, redis, opensearch, backend, celery-worker, frontend, flower
   - **Critical**: Ensures no internet pulls in air-gapped environments
   - Images must be pre-loaded with `docker load`

2. **Frontend Port Fix**:
   - Change port mapping from 80:80 to 80:8080
   - Add healthcheck with correct port 8080
   - Matches nginx configuration

3. **Model Cache**:
   - Add model cache volume mounts to flower service
   - Ensures flower has access to pre-downloaded models

## Root Cause
The frontend container's nginx listens on port 8080 (per nginx.conf), but both
prod and offline compose files were mapping to port 80, causing healthchecks
to fail and making the app unreachable.

## Testing
- Production: Verified with one-line installer
- Offline: Ensures no docker pull attempts in air-gapped systems
- Both: Frontend now accessible and healthy

This resolves the issue where setup completed but the app didn't load.

Author: davidamacey

docker-compose.offline.yml

@@ -7,6 +7,7 @@ version: '3.8'
 services:
   postgres:
     image: postgres:17.5-alpine
+    pull_policy: never
     restart: always
     volumes:
       - postgres_data:/var/lib/postgresql/data/
@@ -25,6 +26,7 @@ services:
 
   minio:
     image: minio/minio:RELEASE.2025-09-07T16-13-09Z
+    pull_policy: never
     restart: always
     volumes:
       - minio_data:/data
@@ -43,6 +45,7 @@ services:
 
   redis:
     image: redis:8.2.2-alpine3.22
+    pull_policy: never
     restart: always
     ports:
       - "${REDIS_PORT:-6379}:6379"
@@ -56,6 +59,7 @@ services:
 
   opensearch:
     image: opensearchproject/opensearch:2.5.0
+    pull_policy: never
     restart: always
     environment:
       - discovery.type=single-node
@@ -79,6 +83,7 @@ services:
 
   backend:
     image: davidamacey/opentranscribe-backend:latest
+    pull_policy: never
     restart: always
     volumes:
       - ${MODEL_CACHE_DIR:-/opt/opentranscribe/models}/huggingface:/root/.cache/huggingface
@@ -150,6 +155,7 @@ services:
 
   celery-worker:
     image: davidamacey/opentranscribe-backend:latest
+    pull_policy: never
     restart: always
     command: celery -A app.core.celery worker --loglevel=info -Q gpu,nlp,utility,celery --concurrency=1
     runtime: nvidia
@@ -215,17 +221,25 @@ services:
 
   frontend:
     image: davidamacey/opentranscribe-frontend:latest
+    pull_policy: never
     restart: always
     ports:
-      - "${FRONTEND_PORT:-80}:80"
+      - "${FRONTEND_PORT:-80}:8080"
     environment:
       - NODE_ENV=production
     depends_on:
       backend:
         condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8080"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
 
   flower:
     image: davidamacey/opentranscribe-backend:latest
+    pull_policy: never
     restart: always
     command: >
       python -m celery -A app.core.celery flower
@@ -243,6 +257,8 @@ services:
       - CELERY_BROKER_URL=redis://redis:6379/0
       - HUGGINGFACE_TOKEN=${HUGGINGFACE_TOKEN:-}
     volumes:
+      - ${MODEL_CACHE_DIR:-/opt/opentranscribe/models}/huggingface:/root/.cache/huggingface
+      - ${MODEL_CACHE_DIR:-/opt/opentranscribe/models}/torch:/root/.cache/torch
       - flower_data:/app
 
 volumes:

docker-compose.prod.yml

@@ -110,6 +110,7 @@ services:
       - JWT_ALGORITHM=${JWT_ALGORITHM:-HS256}
       - JWT_ACCESS_TOKEN_EXPIRE_MINUTES=${JWT_ACCESS_TOKEN_EXPIRE_MINUTES:-60}
       # Models
+      - MODELS_DIRECTORY=${MODELS_DIRECTORY:-/app/models}
       - MODEL_BASE_DIR=${MODEL_BASE_DIR:-/app/models}
       - TEMP_DIR=${TEMP_DIR:-/app/temp}
       # Hardware (auto-detected)
@@ -181,6 +182,7 @@ services:
       - REDIS_PORT=6379
       - OPENSEARCH_HOST=${OPENSEARCH_HOST:-opensearch}
       - OPENSEARCH_PORT=9200
+      - MODELS_DIRECTORY=${MODELS_DIRECTORY:-/app/models}
       - MODEL_BASE_DIR=${MODEL_BASE_DIR:-/app/models}
       - TEMP_DIR=${TEMP_DIR:-/app/temp}
       - TORCH_DEVICE=${TORCH_DEVICE:-auto}
@@ -220,7 +222,7 @@ services:
     pull_policy: always
     restart: always
     ports:
-      - "${FRONTEND_PORT:-5173}:80"
+      - "${FRONTEND_PORT:-5173}:8080"
     environment:
       - NODE_ENV=production
       - VITE_API_BASE_URL=http://localhost:${BACKEND_PORT:-5174}/api
@@ -231,7 +233,7 @@ services:
       backend:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "wget", "--spider", "-q", "http://localhost:80"]
+      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8080"]
       interval: 10s
       timeout: 5s
       retries: 5