Make the backend image install the locked dependency versions

[IzBrain67]

Summary

Until now, every backend image build silently installed whatever the latest PyPI releases were, instead of the versions pinned in poetry.lock. That is how websockets 16 slipped in and broke the Run button (the code fix for that is PR #76). This PR makes builds deterministic again and turns any future lock drift into a loud build failure instead of a silent downgrade to unpinned installs.

Fixes #77.

Changes

• Regenerated poetry.lock (with Poetry 1.8.5, inside a python:3.11.11-slim container) so it is consistent with pyproject.toml again. Existing pins are kept (Django 5.2, websockets 13.1, DRF 3.16); only the missing packages were added.
• Dockerfile: removed the || pip install ... fallback that swallowed the poetry install failure, and the second unpinned pip install line. Added RUN poetry check --lock so an out-of-sync lock fails the build immediately with a clear message. Bumped Poetry 1.7.1 → 1.8.5 (same lock format; adds the check --lock command and matches the version used to generate the lock).
• Removed dependencies the backend never imports: allensdk, openai, fuzzywuzzy, python-Levenshtein. The browser chat calls the OpenAI HTTP API via httpx directly, and the Allen Brain parameter-metadata source is a stub that never calls allensdk. Added numpy explicitly (the results endpoint uses it to read .npz array shapes; previously it was only present as a transitive dependency of allensdk). If the Allen Brain source gets a real implementation later, allensdk just needs to be re-added to pyproject.toml and re-locked.
• requirements.txt (unused convenience file for conda setups) synced to match.

The image shrinks from 2.34 GB to 1.28 GB.

Note on websockets and PR #76

This restores websockets to the locked 13.1 (it was drifting to 16). Current main uses the extra_headers API, which is the ≤13 API, so main works with 13.1. PR #76 migrates to additional_headers, which works on both 13.1 and 16 — so the two PRs can merge in either order without breaking each other.

Verification

• Negative test: with the old (inconsistent) lock, the build now fails loudly at poetry check --lock instead of silently falling back to pip.
• After relocking: image builds; pip list matches the lock (websockets 13.1, Django 5.2, numpy 2.4.6, requests 2.34.2; allensdk/openai/fuzzywuzzy/Levenshtein absent).
• Import smoke test of all runtime deps passes, and websockets.connect still accepts extra_headers (the API main uses).
• docker compose up db backend: migrations + runserver start with no ImportError, system check passes, /api/workflow/ answers with 401 (Keycloak auth) as expected.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MSe2ht7CC1LRudEQVdxK5R

[Copilot]

Pull request overview

This PR makes the workflow backend Docker image build deterministic by enforcing Poetry lockfile consistency and installing only the locked dependency set (removing the prior unpinned pip install fallbacks that hid lock drift). It also prunes unused heavy dependencies and explicitly adds numpy to the main dependency set.

Changes:

• Regenerates poetry.lock with Poetry 1.8.5 to match pyproject.toml, and updates pinned dependency set (notably ensuring websockets stays locked).
• Updates the backend Dockerfile to fail fast on lock drift (poetry check --lock) and install dependencies exclusively via poetry install --only main.
• Removes unused deps (openai, allensdk, fuzzywuzzy, python-Levenshtein) and adds numpy explicitly; syncs the convenience requirements.txt.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

File	Description
gui/workflow_backend/requirements.txt	Removes unused deps and adds numpy to mirror the intended runtime set for local/conda usage.
gui/workflow_backend/pyproject.toml	Updates declared main dependencies (drop unused, add numpy).
gui/workflow_backend/poetry.lock	Re-locks dependencies to align with pyproject.toml using Poetry 1.8.5.
gui/workflow_backend/Dockerfile	Enforces lock consistency and installs only locked main deps (no unpinned pip fallback).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[IzBrain67]

That notebook was one-off verification code, never part of the running system (nothing imports it), and it was the only remaining reference to the openai SDK. It has been removed in 8e984d5 together with the rest of the experimental MCP bundle, so openai intentionally stays out of the dependency set. The browser chat calls the OpenAI HTTP API directly via httpx.

[IzBrain67]

The notebook in question was experiment-only code and has been removed in 8e984d5, so there is no longer anything under the backend that needs the openai SDK — no optional entry needed here.