feat(trainer): training from the collector UI — the trainer becomes a job service, the review page gains a Training section

Trainer: `parking-trainer serve` — a stdlib HTTP job API on the compose network (never
published): /health, /readiness, /versions, /versions/<v>/report, /jobs. One job at a
time; each job runs the CLI as a subprocess with its output captured, state + log
persisted under /out/jobs/ so a restart keeps history. `publish` takes its URL from
TRAINER_PUBLISH_URL. Dockerfile: CMD serve, EXPOSE 8091, healthcheck.

Collector: COLLECTOR_TRAINER_URL + /api/training/{status,jobs,jobs/:id,versions/:v/report}
— a reviewer-gated proxy that forwards a fixed set of paths and whitelisted knobs and
passes the trainer's status codes through (409 while a job runs; 503 unconfigured, 502
unreachable). /review gains the Training section: labels per class vs the minimum with
Train disabled until two classes clear it, mode / backbone / floor, the running job's
live log, the versions with Report / Evaluate / Publish (publish confirms), and the
reminder that pinning stays a git commit. Fixed on the way: an apostrophe in the page's
inline script broke the whole page — a test now parses the script.

Compose: `trainer` is a service (restart: unless-stopped, read-only data volume, its own
trainer-out volume), the `train` profile and TRAINER_OUT are gone; the Docker-socket
route was rejected (root on the host for a service booths upload to). Verified with both
images running together: a Train started through the proxy finished, version and report
came back, the page rendered.

Wiki: bodytype-classifier-training (loop, running it, operating notes superseded),
vision-review-outbox, fleet-deployment-komodo, log.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

apps/trainer/Dockerfile

@@ -1,9 +1,11 @@
 # syntax=docker/dockerfile:1.7
-# Parking TRAINER image: the phase-B body-type classifier job. Build CONTEXT is apps/trainer
-# (self-contained Python package). A ONE-OFF JOB on the reviewer's host (art-docker-station),
-# never a booth service: it reads the wash collector's volume (collector.sqlite + crops/)
-# and writes a versioned model folder. CPU-only PyTorch — the host has no usable GPU and a
-# few thousand crops train in minutes/an hour on four Xeon cores.
+# Parking TRAINER image: the phase-B body-type classifier. Build CONTEXT is apps/trainer
+# (self-contained Python package). Runs on the reviewer's host (art-docker-station) beside
+# the collector, never on a booth: by default it SERVES the job API the collector's Training
+# section drives (`serve`); the same image runs the CLI one-off (`train`, `inspect`, …). It
+# reads the wash collector's volume (collector.sqlite + crops/) and writes versioned model
+# folders. CPU-only PyTorch — the host has no usable GPU and a few thousand crops train in
+# minutes/an hour on four Xeon cores.
 # See wiki/decisions/bodytype-classifier-training.md.
 
 FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim AS base
@@ -37,7 +39,11 @@ RUN useradd --system --create-home --uid 999 trainer \
 USER trainer
 
 ENV TRAINER_DATA_DIR=/data \
-    TRAINER_OUT_DIR=/out
+    TRAINER_OUT_DIR=/out \
+    TRAINER_PORT=8091
 VOLUME ["/out"]
+EXPOSE 8091
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8091/health').status==200 else 1)" || exit 1
 ENTRYPOINT ["uv", "run", "--no-sync", "parking-trainer"]
-CMD ["inspect"]
+CMD ["serve"]