Add docker compose deployment template

Multi-stage image built from the `web` extra only, so it carries no Qt: the
whole web path (webapp, web_session, metrics_json, and the shared analysis
modules) imports no Qt, pyqtgraph or matplotlib canvas. The build stage has the
compiler scipy/numba need; the runtime layer installs the built wheel, so the
same image works from a checkout or a release tarball.

Compose declares no audio volume on purpose. The app keeps no audio, so there is
nothing to persist: `read_only` plus a /tmp tmpfs means request spools are
memory-backed and never reach a disk. Publishing is loopback-only because the
tool has no authentication, and BLAS thread pools are pinned because analysis is
CPU-bound.

Fix three packaging bugs the build surfaced, each of which broke the image:

- `pip install --extra web` is not valid for a source tree; uv wants `.[web]`
  and failed with "Requesting extras requires a pylock.toml".
- The wheel shipped no static assets at all. `package-data` keys match
  *packages*, and the app modules are top-level `py-modules`, so the `"*"` key
  matched nothing - verified by inspecting the built wheel: 14 .py files, zero
  HTML/JS/CSS. An installed `ujm-web` would have 404'd every asset. `static/` is
  now declared a package (hence its packaging-shim `__init__.py`) so the assets
  install next to the modules, which is where `webapp.py` looks for them.
- The Dockerfile's curated COPY list omitted modules that `py-modules` requires,
  failing the build with "file <module>.py not found". It copies the checkout,
  filtered by .dockerignore.

Move PyQt5/pyqtgraph into a `desktop` extra so the web install is genuinely
Qt-free. Verified: `find` for Qt in a web-only venv now returns nothing, and the
desktop path still resolves and imports.

Add scripts/make_fixtures.py so the smoke suite has no network or ffmpeg
dependency (the tagged MP3 is optional and its assertions skip when absent), and
make the suite tolerate that. Verified against the *installed package* running
the container's own command line, from a directory with no source tree:
61/61 passing.

Also correct README claims that had gone stale: BPM (removed), the matplotlib
canvas (replaced by pyqtgraph), and font_control_widget.py (deleted).

pyproject.toml

@@ -6,12 +6,27 @@ build-backend = "setuptools.build_meta"
 name = "uj-mastering-master"
 version = "0.1.0"
 requires-python = ">=3.10"
+
+# Only what the *analysis* needs. The GUI stack lives in the `desktop` extra
+# below, because nothing on the web path touches it: `webapp.py`,
+# `web_session.py`, `metrics_json.py`, `master_core.py`, `metrics.py` and
+# `plotspec.py` import no Qt, no pyqtgraph and no matplotlib canvas. Keeping
+# PyQt5 here would force a `--headless`-style install to drag in a full Qt
+# stack it never loads.
 dependencies = [
     "librosa",
     "numpy",
-    "matplotlib",
+    "matplotlib",       # librosa dependency, and colormaps for the colormap helper
     "mutagen",
     "pyloudnorm",
+]
+
+license = {text = "Apache-2.0"}
+
+[project.optional-dependencies]
+# Desktop GUI. Installed with:
+#   uv sync --extra desktop     (or `uv sync --all-extras`)
+desktop = [
     "PyQt5>=5.15.10",
     # 5.15.2 is the only pyqt5-qt5 release with a Windows wheel; later
     # versions are Linux/macOS only.
@@ -19,19 +34,27 @@ dependencies = [
     "pyqtgraph>=0.14.0",
 ]
 
-license = {text = "Apache-2.0"}
-
-[project.optional-dependencies]
-# Web front end (the `feature/web-ui` branch). Installed with:
+# Web front end. Installed with:
 #   uv sync --extra web
 # Deliberately separate from the desktop path: a server install of the web UI
-# needs no Qt/wheel stack, and a desktop install needs no ASGI stack.
+# needs no Qt/wheel stack. Which is what makes the container image small and
+# lets it run without a display server at all.
 web = [
     "fastapi>=0.110",
     "uvicorn[standard]>=0.27",
     "python-multipart>=0.0.9",   # multipart upload parsing for FastAPI
 ]
 
+[tool.uv]
+# Note: `default-groups` cannot name an entry from `[project.optional-dependencies]`
+# — it only accepts `[dependency-groups]` names, and errors with "Default group
+# `desktop` ... is not defined in the project's `dependency-groups` table".
+# Extras must be requested explicitly, which is why the README spells out both:
+#   uv sync                    # analysis + nothing else
+#   uv sync --extra desktop    # + Qt/pyqtgraph (the GUI; `uv run ujm`)
+#   uv sync --extra web        # + fastapi/uvicorn (`uv run ujm-web`)
+#   uv sync --all-extras       # both
+
 [project.scripts]
 ujm = "main:main"
 ujm-web = "webapp:main"
@@ -54,16 +77,21 @@ py-modules = [
     "web_session",
     "metrics_json",
 ]
+# `static/` is declared a *package* so `package-data` has something to attach
+# to. `package-data` keys match packages, and top-level `py-modules` are not
+# packages — so the earlier `"*" = [...]` form silently matched nothing and the
+# built wheel contained no assets at all (verified: 14 .py files, zero HTML/
+# JS/CSS). An installed `ujm-web` therefore 404'd every asset. With this entry
+# the assets install to `site-packages/static/`, which is exactly where
+# `webapp.py` looks (`Path(__file__).parent / "static"`).
+packages = ["static"]
 
 [tool.setuptools.package-data]
-# Vendored browser assets: uPlot (curves), no CDN at runtime. `webapp.py`
-# resolves them relative to `__file__`, so on an installed wheel they must sit
-# next to the modules — see `[tool.setuptools.data-files]` for the sdist path.
-"*" = ["static/*"]
-
-[tool.setuptools.data-files]
-# The web assets live next to the *modules*, not in site-packages/static, so a
-# wheel install needs them copied into the package directory. `MANIFEST.in`
-# keeps them in the sdist; running from a checkout (the documented path) needs
-# neither.
-"lib/python-static" = ["static/*"]
+# Vendored browser assets: uPlot (curves), no CDN at runtime. Keyed on the
+# `static` package (declared above) rather than `"*"`: a `"*"` key matches
+# *packages*, and there are none besides `static` — the app modules are
+# top-level `py-modules`, which is why the original form shipped nothing.
+#
+# `**/*` rather than `*` so the glob reaches `static/vendor/`, where the uPlot
+# bundle lives.
+static = ["*", "**/*"]