Merge remote-tracking branch 'origin/master'

# Conflicts:
#	docker-compose.yml

docker-compose.yml

@@ -9,6 +9,7 @@ services:
       - "8000:8000"
     environment:
       CLEANUP_APPLY_ENABLED: "${CLEANUP_APPLY_ENABLED:-false}"
+      AI_CONVERTER_URL: http://ai-converter:8090
     volumes:
       - wordcloud_workspace:/app/service_workspace
       - wordcloud_assets:/app/service_assets
@@ -19,6 +20,9 @@ services:
       - wordcloud_metadata:/app/service_metadata
       - wordcloud_orders:/app/service_orders
     restart: unless-stopped
+    depends_on:
+      ai-converter:
+        condition: service_healthy
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8000/api/health"]
       interval: 30s
@@ -26,6 +30,27 @@ services:
       retries: 3
       start_period: 60s
 
+  # Private SVG -> AI5 converter.  It deliberately has no published host port;
+  # browser traffic must go through the backend's /api/exports/ai endpoint.
+  ai-converter:
+    image: "${HARBOR_REGISTRY:-114.55.99.6:10081}/wordcloud/wordcloud-ai-converter:${IMAGE_TAG:-latest}"
+    build:
+      context: ./ai-converter
+      dockerfile: Dockerfile
+    container_name: wordcloud-ai-converter
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8090/health', timeout=3).read()"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+
   frontend:
     image: "${HARBOR_REGISTRY:-114.55.99.6:10081}/wordcloud/wordcloud-frontend:${IMAGE_TAG:-latest}"
     build: