[AZ-178] Implement streaming video detection endpoint

- Added `/detect/video` endpoint for true streaming video detection, allowing inference to start as upload bytes arrive.
- Introduced `run_detect_video_stream` method in the inference module to handle video processing from a file-like object.
- Updated media hashing to include a new function for computing hashes directly from files with minimal I/O.
- Enhanced documentation to reflect changes in video processing and API behavior.

Made-with: Cursor

_docs/04_deploy/containerization.md

@@ -0,0 +1,125 @@
+# Containerization Plan
+
+## Image Variants
+
+### detections-cpu (Dockerfile)
+
+| Aspect | Specification |
+|--------|--------------|
+| Base image | `python:3.11-slim` (pinned digest recommended) |
+| Build stages | Single stage (Cython compile requires gcc at runtime for setup.py) |
+| Non-root user | `adduser --disabled-password --gecos '' appuser` + `USER appuser` |
+| Health check | `HEALTHCHECK --interval=30s --timeout=5s CMD curl -f http://localhost:8080/health \|\| exit 1` |
+| Exposed ports | 8080 |
+| Entrypoint | `uvicorn main:app --host 0.0.0.0 --port 8080` |
+
+**Changes needed to existing Dockerfile**:
+1. Add non-root user (security finding F7)
+2. Add HEALTHCHECK directive
+3. Pin `python:3.11-slim` to specific digest
+4. Add `curl` to apt-get install (for health check)
+
+### detections-gpu (Dockerfile.gpu)
+
+| Aspect | Specification |
+|--------|--------------|
+| Base image | `nvidia/cuda:12.2.0-runtime-ubuntu22.04` |
+| Build stages | Single stage |
+| Non-root user | `adduser --disabled-password --gecos '' appuser` + `USER appuser` |
+| Health check | `HEALTHCHECK --interval=30s --timeout=5s CMD curl -f http://localhost:8080/health \|\| exit 1` |
+| Exposed ports | 8080 |
+| Entrypoint | `uvicorn main:app --host 0.0.0.0 --port 8080` |
+| Runtime | Requires `--runtime=nvidia` or `nvidia` runtime in Docker |
+
+**Changes needed to existing Dockerfile.gpu**:
+1. Add non-root user
+2. Add HEALTHCHECK directive
+3. Add `curl` to apt-get install
+
+### .dockerignore
+
+```
+.git
+.gitignore
+_docs/
+_standalone/
+e2e/
+tests/
+*.md
+.env
+.env.*
+.cursor/
+.venv/
+venv/
+__pycache__/
+*.pyc
+build/
+dist/
+*.egg-info
+Logs/
+```
+
+## Docker Compose — Local Development
+
+`docker-compose.yml` (already partially exists as `e2e/docker-compose.mocks.yml`):
+
+```yaml
+name: detections-dev
+
+services:
+  mock-loader:
+    build: ./e2e/mocks/loader
+    ports:
+      - "18080:8080"
+    volumes:
+      - ./e2e/fixtures:/models
+    networks:
+      - dev-net
+
+  mock-annotations:
+    build: ./e2e/mocks/annotations
+    ports:
+      - "18081:8081"
+    networks:
+      - dev-net
+
+  detections:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    ports:
+      - "8080:8080"
+    depends_on:
+      - mock-loader
+      - mock-annotations
+    env_file: .env
+    environment:
+      LOADER_URL: http://mock-loader:8080
+      ANNOTATIONS_URL: http://mock-annotations:8081
+    volumes:
+      - ./e2e/fixtures/classes.json:/app/classes.json:ro
+      - detections-logs:/app/Logs
+    shm_size: 512m
+    networks:
+      - dev-net
+
+volumes:
+  detections-logs:
+
+networks:
+  dev-net:
+    driver: bridge
+```
+
+## Docker Compose — Blackbox Tests
+
+Already exists: `e2e/docker-compose.test.yml`. No changes needed — supports both `cpu` and `gpu` profiles with mock services and test runner.
+
+## Image Tagging Strategy
+
+| Context | Tag Format | Example |
+|---------|------------|---------|
+| CI builds | `<registry>/azaion/detections-cpu:<git-sha>` | `registry.example.com/azaion/detections-cpu:a1b2c3d` |
+| CI builds (GPU) | `<registry>/azaion/detections-gpu:<git-sha>` | `registry.example.com/azaion/detections-gpu:a1b2c3d` |
+| Local development | `detections-cpu:dev` | — |
+| Latest stable | `<registry>/azaion/detections-cpu:latest` | Updated on merge to main |