fix(docker): resolve 4 release-blocking issues from validation

- fix(rate-limit): treat RATE_LIMIT_PER_MIN=0 as unlimited (50k/min)
  instead of blocking all requests. @fastify/rate-limit interprets
  max:0 as "allow zero requests," breaking fresh container startups.

- fix(docker): add libgles2 for MediaPipe face detection tools.
  blur-faces, red-eye-removal, enhance-faces, and passport-photo
  failed with "libGLESv2.so.2 not found" on all headless containers.

- fix(docker/arm64): remove conflicting system libheif1 to avoid
  ABI symbol mismatch with our custom libheif 1.21.2 build.
  heif-convert failed with "undefined symbol: heif_get_plugin_directories."

- fix(docker/arm64): pre-install wheel+setuptools in base Python venv
  so basicsr can build from source on arm64 (no pre-built wheel).
  This unblocks upscale-enhance and photo-restoration bundles.

.gitignore

@@ -48,7 +48,7 @@ docs/*
 PRD.md
 
 # Ad-hoc test screenshots and reports
-tests/e2e/screenshots/qa/**/*.png
+tests/e2e/screenshots/qa/
 test-*.png
 !tests/fixtures/*.png
 stirling-pdf-*.png

apps/api/src/index.ts

@@ -184,8 +184,9 @@ app.addHook("onSend", async (_request, reply) => {
 });
 
 // Always register rate-limit plugin so per-route limits (login brute-force protection) work.
+// max=0 means "unlimited" (50k/min) -- @fastify/rate-limit treats literal 0 as "block all".
 await app.register(rateLimit, {
-  max: env.RATE_LIMIT_PER_MIN,
+  max: env.RATE_LIMIT_PER_MIN > 0 ? env.RATE_LIMIT_PER_MIN : 50_000,
   timeWindow: "1 minute",
   allowList: (request) => !request.url.startsWith("/api/"),
 });

docker/Dockerfile

@@ -194,7 +194,7 @@ RUN for i in 1 2 3; do apt-get -o Acquire::Retries=3 update && break || sleep $(
     tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-fra tesseract-ocr-spa \
     tesseract-ocr-chi-sim tesseract-ocr-jpn tesseract-ocr-kor \
     gcc g++ \
-    libgl1 libglib2.0-0 \
+    libgl1 libglib2.0-0 libgles2 \
     libegl1 libwayland-egl1 libwayland-client0 libwayland-cursor0 \
     libxkbcommon-x11-0 libxkbcommon0 libxcursor1 \
     && if apt-cache show libmagickcore-6.q16-7-extra >/dev/null 2>&1; then \
@@ -225,9 +225,11 @@ RUN POLICY_FILE=$(find /etc/ImageMagick* -name policy.xml 2>/dev/null | head -1)
 # Caire binary (content-aware seam carving)
 COPY --from=caire-builder /tmp/caire /usr/local/bin/caire
 
-# libheif tools (heif-convert, heif-dec, heif-enc) built from source
+# libheif tools (heif-convert, heif-dec, heif-enc) built from source.
+# LD_LIBRARY_PATH ensures our custom 1.21.2 libs take precedence over distro libheif1.
 COPY --from=libheif-builder /opt/libheif/bin/ /usr/local/bin/
 COPY --from=libheif-builder /opt/libheif/lib/ /usr/local/lib/
+ENV LD_LIBRARY_PATH=/usr/local/lib
 RUN ldconfig
 
 # Python venv - Base packages (rarely change, cached aggressively)
@@ -235,6 +237,7 @@ RUN ldconfig
 RUN --mount=type=cache,target=/root/.cache/pip \
     python3 -m venv /opt/venv && \
     /opt/venv/bin/pip install --upgrade "pip==25.1.1" && \
+    /opt/venv/bin/pip install wheel setuptools && \
     /opt/venv/bin/pip install \
         Pillow==11.1.0 \
         numpy==1.26.4 \

package.json

@@ -1,6 +1,6 @@
 {
   "name": "snapotter",
-  "version": "1.17.1",
+  "version": "1.17.2",
   "private": true,
   "description": "Self-hosted image processing suite with 50+ tools and local AI. Single Docker container, no external services.",
   "homepage": "https://snapotter.com",