Improve Docker dependency caching and isolate Python runtime

apps/python/Dockerfile

@@ -1,8 +1,22 @@
-FROM python:3.12-slim
+FROM python:3.12-slim AS base
 RUN apt-get update && apt-get install -y --no-install-recommends ffmpeg fonts-noto-cjk && rm -rf /var/lib/apt/lists/*
+
+FROM base AS dependencies
+ENV PATH="/opt/venv/bin:$PATH"
 WORKDIR /app
+RUN python -m venv /opt/venv
+COPY apps/python/pyproject.toml ./
+# Read the pinned requirements from the package metadata before copying source.
+RUN python -c 'import subprocess, tomllib; p = tomllib.load(open("pyproject.toml", "rb")); subprocess.check_call(["python", "-m", "pip", "install", "--no-cache-dir", *p["build-system"]["requires"], *p["project"]["dependencies"]])'
+
+FROM dependencies AS build
 COPY apps/python/ .
-RUN pip install --no-cache-dir . && python -m unittest discover -s tests -v
+RUN pip install --no-cache-dir --no-deps --no-build-isolation . && python -m unittest discover -s tests -v
+
+FROM base AS runtime
+WORKDIR /app
+ENV PATH="/opt/venv/bin:$PATH"
+COPY --from=build /opt/venv /opt/venv
 RUN useradd --create-home exporter
 USER exporter
 ENTRYPOINT ["prompt-export"]