Fix SPA routing guard and set demo env

- Prevent catch-all SPA route from intercepting API/docs paths
- Set APP_ENV=demo to keep docs accessible for demo

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Dockerfile

@@ -37,7 +37,7 @@ RUN mkdir -p uploads model_cache data && \
     chown -R appuser:appuser /app
 
 ENV PORT=7860
-ENV APP_ENV=production
+ENV APP_ENV=demo
 ENV LOG_LEVEL=INFO
 ENV TRANSFORMERS_CACHE=/app/model_cache
 ENV SENTENCE_TRANSFORMERS_HOME=/app/model_cache

backend/app/main.py

@@ -97,6 +97,9 @@ if STATIC_DIR.is_dir():
     @app.get("/{full_path:path}")
     async def serve_spa(full_path: str):
         """Serve the SPA index.html for all non-API routes."""
+        # Don't intercept API, docs, health, or metrics paths
+        if full_path.startswith(("api/", "docs", "redoc", "openapi.json", "health", "metrics")):
+            return JSONResponse(status_code=404, content={"detail": "Not found"})
         file_path = STATIC_DIR / full_path
         if file_path.is_file():
             return FileResponse(str(file_path))