feat: classify sensitive columns locally

docker/core.Dockerfile

@@ -41,6 +41,7 @@ RUN npm run build
 FROM python:3.12-slim-bookworm@sha256:d50fb7611f86d04a3b0471b46d7557818d88983fc3136726336b2a4c657aa30b AS runtime
 ARG PI_VERSION
 ARG IMAGE_VERSION
+ARG INSTALL_SENSITIVITY_NER=false
 LABEL org.opencontainers.image.title="thothii-core" \
       org.opencontainers.image.version="${IMAGE_VERSION}" \
       org.opencontainers.image.description="ThothII core with its embedded Pi runtime" \
@@ -48,7 +49,7 @@ LABEL org.opencontainers.image.title="thothii-core" \
 
 # Runtime tools
 RUN set -eux; \
-    runtime_packages="curl ca-certificates ripgrep fd-find tini git openssh-client"; \
+    runtime_packages="curl ca-certificates ripgrep fd-find tini git openssh-client libseccomp2"; \
     if ! command -v flock >/dev/null 2>&1; then \
         runtime_packages="$runtime_packages util-linux"; \
     fi; \
@@ -93,10 +94,22 @@ RUN mkdir -p /app/harness/config \
 # PiProcessManager (backend) prepende harnessDir/.venv/bin al PATH del child Pi → symlink al venv reale
 RUN ln -s /opt/venv /app/harness/.venv
 
+# The optional NER dependency layer is independent of backend source and build artifacts so it can
+# be reused when only TypeScript or worker code changes.
+COPY backend/python/sensitivity-ner-requirements.txt /app/backend/python/sensitivity-ner-requirements.txt
+RUN if [ "$INSTALL_SENSITIVITY_NER" = "true" ]; then \
+      python -m venv /opt/sensitivity-ner; \
+      /opt/sensitivity-ner/bin/pip install --no-cache-dir --upgrade pip; \
+      /opt/sensitivity-ner/bin/pip install --no-cache-dir -r /app/backend/python/sensitivity-ner-requirements.txt; \
+    elif [ "$INSTALL_SENSITIVITY_NER" != "false" ]; then \
+      echo "INSTALL_SENSITIVITY_NER must be true or false" >&2; exit 2; \
+    fi
+
 # Backend: dist + node_modules (stesso Node major 24 + glibc bookworm → compatibili)
 COPY --from=backend-build /src/backend/dist /app/backend/dist
 COPY --from=backend-build /src/backend/node_modules /app/backend/node_modules
 COPY backend/scripts/ssh-askpass.mjs /app/backend/scripts/ssh-askpass.mjs
+COPY backend/python /app/backend/python
 COPY backend/package*.json /app/backend/
 RUN chmod 0755 /app/backend/scripts/ssh-askpass.mjs