replace ProspectOS with BrowserOnly build

docker-compose.yml

@@ -1,123 +1,21 @@
 services:
-  api:
+  app:
     build:
-      context: ./apps/api
-      dockerfile: Dockerfile
-    image: prospect-platform-api:local
-    environment:
-      APP_ENV: ${APP_ENV:-development}
-      API_HOST: 0.0.0.0
-      API_PORT: 8000
-      LOG_LEVEL: ${LOG_LEVEL:-INFO}
-      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:8080}
-      SESSION_SECRET: ${SESSION_SECRET:-}
-      DATA_DIR: /data
-      # Optional first-run admin bootstrap; leave unset after provisioning.
-      BOOTSTRAP_ADMIN_EMAIL: ${BOOTSTRAP_ADMIN_EMAIL:-}
-      BOOTSTRAP_ADMIN_PASSWORD: ${BOOTSTRAP_ADMIN_PASSWORD:-}
-      AI_RESEARCH_PROVIDER: ${AI_RESEARCH_PROVIDER:-}
-      AI_RESEARCH_PROVIDER_MODEL: ${AI_RESEARCH_PROVIDER_MODEL:-}
-      AI_RESEARCH_PROVIDER_URL: ${AI_RESEARCH_PROVIDER_URL:-}
-      AI_RESEARCH_PROVIDER_ALLOWED_HOSTS: ${AI_RESEARCH_PROVIDER_ALLOWED_HOSTS:-}
-      AI_RESEARCH_PROVIDER_API_KEY: ${AI_RESEARCH_PROVIDER_API_KEY:-}
-      # Native Nous Portal tool-calling research (server-side secrets only).
-      NOUS_API_KEY: ${NOUS_API_KEY:-}
-      NOUS_MODEL: ${NOUS_MODEL:-Hermes-4-405B}
-      NOUS_BASE_URL: ${NOUS_BASE_URL:-https://inference-api.nousresearch.com/v1}
-      NOUS_ALLOWED_HOSTS: ${NOUS_ALLOWED_HOSTS:-inference-api.nousresearch.com}
-      SEARXNG_BASE_URL: ${SEARXNG_BASE_URL:-http://searxng:8080}
-      SEARXNG_ALLOWED_HOSTS: ${SEARXNG_ALLOWED_HOSTS:-searxng}
-      FIRECRAWL_API_KEY: ${FIRECRAWL_API_KEY:-}
-      FIRECRAWL_BASE_URL: ${FIRECRAWL_BASE_URL:-https://api.firecrawl.dev/v2}
-      FIRECRAWL_ALLOWED_HOSTS: ${FIRECRAWL_ALLOWED_HOSTS:-api.firecrawl.dev}
-      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
-      # Deprecated migration-only generic search adapter.
-      SEARCH_PROVIDER_URL: ${SEARCH_PROVIDER_URL:-}
-      SEARCH_PROVIDER_ALLOWED_HOSTS: ${SEARCH_PROVIDER_ALLOWED_HOSTS:-}
-      SEARCH_PROVIDER_API_KEY: ${SEARCH_PROVIDER_API_KEY:-}
-      # Experimental public-result connector stays fail-closed unless overridden explicitly.
-      GOOGLE_BROWSER_SEARCH_ENABLED: true
-      AUTOMATED_OUTREACH_ENABLED: "false"
-    volumes:
-      - prospect_api_data:/data
-    read_only: true
-    init: true
-    pids_limit: 128
-    tmpfs:
-      - /tmp
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
-    healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/api/v1/health/ready', timeout=2)"]
-      interval: 10s
-      timeout: 3s
-      retries: 5
-      start_period: 5s
-    restart: unless-stopped
-    networks:
-      - prospect_internal
-      - source_egress
-
-  web:
-    build:
-      context: ./apps/web
-      dockerfile: Dockerfile
-    image: prospect-platform-web:local
-    environment:
-      API_UPSTREAM_HOST: api
-      API_UPSTREAM_PORT: "8000"
-      AUTOMATED_OUTREACH_ENABLED: "false"
+      context: .
+      dockerfile: api/Dockerfile
     ports:
-      - "${WEB_PORT:-8080}:8080"
-    read_only: true
-    init: true
-    pids_limit: 128
-    tmpfs:
-      - /tmp
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
+      - "8000:8000"
+    environment:
+      PROSPECT_DB: /data/prospects.db
+      PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH: /usr/bin/chromium
+    volumes:
+      - prospect_data:/data
+    restart: unless-stopped
     healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)"]
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/api/health', timeout=2)"]
       interval: 10s
       timeout: 3s
       retries: 5
-      start_period: 3s
-    restart: unless-stopped
-    networks:
-      - prospect_internal
-      - web_ingress
-
-  searxng:
-    image: searxng/searxng:latest
-    environment:
-      SEARXNG_SECRET_KEY: ${SEARXNG_SECRET_KEY:-change-me-in-production}
-    volumes:
-      - ./searxng/settings.yml:/etc/searxng/settings.yml:ro
-    read_only: true
-    tmpfs:
-      - /tmp
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
-    expose:
-      - "8080"
-    networks:
-      - prospect_internal
-      - searxng_egress
-    restart: unless-stopped
 
 volumes:
-  prospect_api_data:
-    name: prospect-platform-api-data
-
-networks:
-  prospect_internal:
-    internal: true
-  source_egress:
-  searxng_egress:
-  web_ingress:
+  prospect_data: