feat: 完善 N7 智能座舱交互与控制链路

deploy/server/Dockerfile

@@ -1,12 +1,28 @@
+FROM node:22-bookworm-slim AS codex-cli
+
+ARG CODEX_CLI_VERSION=0.150.0-alpha.8
+RUN npm install --global "@openai/codex@${CODEX_CLI_VERSION}" \
+    && codex --version
+
 FROM python:3.12-slim-bookworm
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     PIP_DISABLE_PIP_VERSION_CHECK=1 \
-    PYTHONPATH=/app/src:/app/domains/seat/src
+    PYTHONPATH=/app/src:/app/domains/seat/src \
+    HOME=/home/cognitive-agent \
+    CODEX_HOME=/var/lib/codex
 
 WORKDIR /app
 
+RUN apt-get update \
+    && apt-get install --yes --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=codex-cli /usr/local/bin/node /usr/local/bin/node
+COPY --from=codex-cli /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s ../lib/node_modules/@openai/codex/bin/codex.js /usr/local/bin/codex
+
 COPY pyproject.toml ./
 COPY src ./src
 COPY apps ./apps
@@ -15,7 +31,20 @@ COPY contracts ./contracts
 COPY domains ./domains
 COPY platforms ./platforms
 
-RUN python -m pip install --no-cache-dir ".[llm]"
+RUN node --version \
+    && codex --version \
+    && python -m pip install --no-cache-dir ".[llm,speech]" \
+    && groupadd --gid 10001 cognitive-agent \
+    && useradd --uid 10001 --gid 10001 --create-home cognitive-agent \
+    && mkdir -p /var/lib/codex \
+        /app/artifacts/runs \
+        /app/artifacts/user-presets \
+        /app/artifacts/server \
+        /app/artifacts/tmp \
+        /app/artifacts/self-repair \
+    && chown -R 10001:10001 /var/lib/codex /app/artifacts /home/cognitive-agent
+
+USER 10001:10001
 
 EXPOSE 8000