fix: resolve runtime model path mismatch for non-root Docker user

Set U2NET_HOME=/opt/models/rembg so rembg models pre-downloaded at
build time as root are found at runtime by the non-root ashim user.
Without this every fresh container re-downloaded the 973 MB BiRefNet
models on first background-removal request.

Apply the same fix to PaddleOCR: download to /opt/models/paddlex and
symlink into both /root/.paddlex and /app/.paddlex so PaddleX finds
models regardless of which HOME gosu resolves at runtime.

Fall back to per-request spawning in bridge.ts when the persistent
dispatcher crashes mid-request (e.g. OOM loading a large ONNX model),
so the operation succeeds instead of surfacing "Python dispatcher
exited unexpectedly" to the user.

Improve entrypoint.sh permission warning to mention Windows bind mounts
as the likely cause.

packages/ai/src/bridge.ts

@@ -356,7 +356,15 @@ export function runPythonWithProgress(
   // Try persistent dispatcher first
   const dispatcherPromise = dispatcherRun(scriptName, args, options);
   if (dispatcherPromise) {
-    return dispatcherPromise;
+    return dispatcherPromise.catch((err: Error) => {
+      // Dispatcher crashed mid-request (e.g. OOM when loading a large model).
+      // Retry in an isolated per-request process which starts clean and has
+      // more available memory than the warm dispatcher.
+      if (err.message === "Python dispatcher exited unexpectedly") {
+        return runPythonPerRequest(scriptName, args, options);
+      }
+      throw err;
+    });
   }
 
   // Fall back to per-request spawning