chore(docker): add cfcore-aware Dockerfile and test compose

- Dockerfile: restored to original (build: . context, no cfcore) so
  existing compose.yml / compose.cloud.yml builds are unaffected
- Dockerfile.cfcore: parent-context build that copies circuitforge-core/
  alongside peregrine/ before pip install; resolves -e ../circuitforge-core
- compose.test-cfcore.yml: single-user test instance on port 8516;
  run from parent dir with context: .. so both repos are in scope

Use this to smoke-test cfcore shims before promoting to prod cloud.

Dockerfile.cfcore

@@ -0,0 +1,44 @@
+# Dockerfile.cfcore — build context must be the PARENT directory of peregrine/
+#
+# Used when circuitforge-core is installed from source (not PyPI).
+# Both repos must be siblings on the build host:
+#   /devl/peregrine/          → WORKDIR /app
+#   /devl/circuitforge-core/  → installed to /circuitforge-core
+#
+# Build manually:
+#   docker build -f peregrine/Dockerfile.cfcore -t peregrine-cfcore ..
+#
+# Via compose (compose.test-cfcore.yml sets context: ..):
+#   docker compose -f compose.test-cfcore.yml build
+FROM python:3.11-slim
+
+WORKDIR /app
+
+# System deps for companyScraper (beautifulsoup4, fake-useragent, lxml) and PDF gen
+# libsqlcipher-dev: required to build pysqlcipher3 (SQLCipher AES-256 encryption for cloud mode)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc libffi-dev curl libsqlcipher-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy circuitforge-core first so pip can resolve the -e ../circuitforge-core
+# reference in requirements.txt (installed editable at /circuitforge-core)
+COPY circuitforge-core/ /circuitforge-core/
+
+COPY peregrine/requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Install Playwright browser (cached separately from Python deps so requirements
+# changes don't bust the ~600–900 MB Chromium layer and vice versa)
+RUN playwright install chromium && playwright install-deps chromium
+
+# Bundle companyScraper (company research web scraper)
+COPY peregrine/scrapers/ /app/scrapers/
+
+COPY peregrine/ .
+
+EXPOSE 8501
+
+CMD ["streamlit", "run", "app/app.py", \
+     "--server.port=8501", \
+     "--server.headless=true", \
+     "--server.fileWatcherType=none"]

compose.test-cfcore.yml

@@ -0,0 +1,34 @@
+# compose.test-cfcore.yml — single-user test instance for circuitforge-core integration
+#
+# Run from the PARENT directory of peregrine/ (the build context must include
+# both peregrine/ and circuitforge-core/ as siblings):
+#
+#   cd /devl   (or /Library/Development/CircuitForge on dev)
+#   docker compose -f peregrine/compose.test-cfcore.yml --project-name peregrine-test up -d
+#   docker compose -f peregrine/compose.test-cfcore.yml --project-name peregrine-test logs -f
+#   docker compose -f peregrine/compose.test-cfcore.yml --project-name peregrine-test down
+#
+# UI: http://localhost:8516
+# Purpose: smoke-test circuitforge-core shims (db, llm_router, tiers, task_scheduler)
+#          before promoting cfcore integration to the production cloud instance.
+
+services:
+  app:
+    build:
+      context: ..
+      dockerfile: peregrine/Dockerfile.cfcore
+    container_name: peregrine-test-cfcore
+    ports:
+      - "8516:8501"
+    volumes:
+      - peregrine-test-data:/devl/job-seeker
+    environment:
+      - STAGING_DB=/devl/job-seeker/staging.db
+      - PYTHONUNBUFFERED=1
+      - STREAMLIT_SERVER_BASE_URL_PATH=
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    restart: "no"
+
+volumes:
+  peregrine-test-data: