fix(ingest): flush Document before FK inserts; build fixes; shared-minio overlay

.gitignore

@@ -26,3 +26,5 @@ var/
 # local preview launch config
 frontend/.claude/
 .claude/launch.json
+
+.env.*.bak

app/ingestion/knowledge_ingest.py

@@ -139,6 +139,13 @@ class SqlAlchemyKnowledgeIngestRepository:
                     if existing_doc.status == DocumentStatus.DISCOVERED:
                         existing_doc.status = DocumentStatus.STORED_ORIGINAL
 
+                # Flush the Document row before FK-dependent inserts: there is no
+                # ORM relationship between AssetIngestJob/DocumentArtifact and
+                # Document, so the unit of work does not order these INSERTs and
+                # PostgreSQL rejects the job row with a ForeignKeyViolation
+                # (SQLite-based tests do not enforce FKs, hence unseen there).
+                db.flush()
+
                 ensure_artifact(
                     db,
                     document_id=document_id,

docker-compose.shared-minio.yml

@@ -0,0 +1,28 @@
+# Shared-minio migration overlay (phase 1 of
+# TeamHUB-Platform/docs/submodules/plans/2026-07-08-shared-minio-migration-prompt.md).
+# Attaches ONLY api and worker to the shared teamhub_net so they can reach the
+# platform MinIO (alias teamhub-minio) from container start. Unlike
+# docker-compose.teamhub.yml this overlay does not strip host ports from data
+# services and does not enable AUTH_REQUIRE_IDENTITY - local debug contour.
+#
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.shared-minio.yml up -d --no-deps api worker
+
+networks:
+  teamhub_net:
+    external: true
+    name: teamhub_net
+
+services:
+  api:
+    networks:
+      edge: {}
+      legacyhub_db: {}
+      teamhub_net:
+        aliases: [legacyhub-api]
+
+  worker:
+    networks:
+      edge: {}
+      legacyhub_db: {}
+      teamhub_net: {}

docker/Dockerfile

@@ -22,6 +22,7 @@ RUN apt-get update \
         build-essential \
         curl \
         ca-certificates \
+        git \
         ghostscript \
         qpdf \
         unpaper \
@@ -51,7 +52,14 @@ COPY pyproject.toml README.md alembic.ini /app/
 COPY app /app/app
 COPY scripts /app/scripts
 
+# Local build: install the recognition engine from a pre-built wheel (the
+# pinned git source lives in a private GitHub repo unreachable from the build
+# container without credentials), then relax the pyproject pin to a version
+# spec inside this layer only - the repo file stays untouched.
+COPY docker/wheels /tmp/wheels
 RUN pip install --upgrade pip wheel setuptools \
+ && pip install /tmp/wheels/*.whl \
+ && sed -i 's|"teamhub-document-recognition-engine @ git+[^"]*"|"teamhub-document-recognition-engine>=0.1.0"|' pyproject.toml \
  && pip install -e .
 
 RUN mkdir -p /data/input /data/work