fix: use --extra-index-url so pip can resolve torch's build deps

The build failed at the PyTorch pip step with:
ERROR: No matching distribution found for flit_core<4,>=3.11

Root cause: the PyTorch index lists the package as "typing-extensions"
while the wheel metadata declares "typing_extensions". Modern pip rejects
that name mismatch, discards the wheel, and falls back to a source build,
which needs flit_core — but --index-url had replaced PyPI, and the PyTorch
index carries neither flit_core nor most of torch's other deps.

--extra-index-url keeps PyPI primary so both the correctly-named wheel and
flit_core resolve. Pinned torch to 2.5.1+cpu (matching the version the
models were trained with) and the +cpu local version keeps the 196MB CPU
wheel rather than PyPI's 555MB CUDA build.

Previous builds passed only because the layer was cached; the cache went
cold on this export and exposed the latent problem.

Dockerfile

@@ -41,10 +41,16 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN npm install -g tsx
 
 # --- Python ML deps (CPU-only PyTorch + TensorFlow) ---
+# Must be --extra-index-url, not --index-url. The PyTorch index lists the package
+# as "typing-extensions" while the wheel metadata says "typing_extensions"; modern
+# pip rejects that mismatch, discards the wheel, and falls back to a source build
+# that needs flit_core — which --index-url had removed PyPI as a source for.
+# Keeping PyPI primary supplies flit_core and the correctly-named wheel.
+# The +cpu local version keeps the 196MB CPU build instead of PyPI's 555MB CUDA one.
 RUN pip install --no-cache-dir --break-system-packages \
     "numpy>=1.26.0,<2.0.0" \
-    torch torchvision \
-    --index-url https://download.pytorch.org/whl/cpu
+    "torch==2.5.1+cpu" "torchvision==0.20.1+cpu" \
+    --extra-index-url https://download.pytorch.org/whl/cpu
 
 RUN pip install --no-cache-dir --break-system-packages \
     "numpy>=1.26.0,<2.0.0" \