[AZ-178] Fix Critical/High security findings: auth, CVEs, non-root containers, per-job SSE

- Pin all deps; h11==0.16.0 (CVE-2025-43859), python-multipart>=1.3.1 (CVE-2026-28356), PyJWT==2.12.1
- Add HMAC JWT verification (require_auth FastAPI dependency, JWT_SECRET-gated)
- Fix TokenManager._refresh() to use ADMIN_API_URL instead of ANNOTATIONS_URL
- Rename POST /detect → POST /detect/image (image-only, rejects video files)
- Replace global SSE stream with per-job SSE: GET /detect/{media_id} with event replay buffer
- Apply require_auth to all 4 protected endpoints
- Fix on_annotation/on_status closure to use mutable current_id for correct post-upload event routing
- Add non-root appuser to Dockerfile and Dockerfile.gpu
- Add JWT_SECRET to e2e/docker-compose.test.yml and run-tests.sh
- Update all e2e tests and unit tests for new endpoints and HMAC token signing
- 64/64 tests pass

Made-with: Cursor

e2e/tests/test_performance.py

@@ -19,14 +19,15 @@ def _percentile_ms(sorted_ms, p):
 
 @pytest.mark.timeout(60)
 def test_nft_perf_01_single_image_latency_p95(
-    warm_engine, http_client, image_small
+    warm_engine, http_client, image_small, auth_headers
 ):
     times_ms = []
     for _ in range(10):
         t0 = time.perf_counter()
         r = http_client.post(
-            "/detect",
+            "/detect/image",
             files={"file": ("img.jpg", image_small, "image/jpeg")},
+            headers=auth_headers,
             timeout=8,
         )
         elapsed_ms = (time.perf_counter() - t0) * 1000.0
@@ -46,12 +47,13 @@ def test_nft_perf_01_single_image_latency_p95(
 
 @pytest.mark.timeout(60)
 def test_nft_perf_03_tiling_overhead_large_image(
-    warm_engine, http_client, image_small, image_large
+    warm_engine, http_client, image_small, image_large, auth_headers
 ):
     t_small = time.perf_counter()
     r_small = http_client.post(
-        "/detect",
+        "/detect/image",
         files={"file": ("small.jpg", image_small, "image/jpeg")},
+        headers=auth_headers,
         timeout=8,
     )
     small_ms = (time.perf_counter() - t_small) * 1000.0
@@ -61,9 +63,10 @@ def test_nft_perf_03_tiling_overhead_large_image(
     )
     t_large = time.perf_counter()
     r_large = http_client.post(
-        "/detect",
+        "/detect/image",
         files={"file": ("large.jpg", image_large, "image/jpeg")},
         data={"config": config},
+        headers=auth_headers,
         timeout=20,
     )
     large_ms = (time.perf_counter() - t_large) * 1000.0