fix: three issues found while running the untested paths after merge

[feRpicoral]

Validation pass against main after PR #11 merged. Three real bugs surfaced from actually running the things I'd flagged as untested.

1. fix(deps): pin huggingface-hub<1.0 for transformers 4.x compatibility

After uv sync against the merged main, vLLM imports crash with:

ImportError: huggingface-hub>=0.34.0,<1.0 is required for a normal functioning of this module, but found huggingface-hub==1.16.1.

Root cause: constraints/serve.txt pins transformers<5.0 (because vLLM 0.11 calls Qwen2Tokenizer.all_special_tokens_extended which 5.x removed), and transformers 4.x in turn requires huggingface-hub<1.0. But gradio (added in PR #9) pulled huggingface-hub==1.16.1 into uv.lock. The lock + the constraint contradicted each other.

Fix: pin huggingface-hub<1.0 in pyproject.toml so the lock is coherent with the runtime constraint. Verified:

• uv pip install -c constraints/serve.txt vllm transformers → vllm 0.11.0 + transformers 4.57.6 + huggingface-hub 0.36.2
• make rehearse runs end-to-end cleanly

2. fix(hf-spaces): move theme to launch() for gradio 6.0 compatibility

Launched the HF Spaces app for real (OPENAI_BASE_URL=http://localhost:8000/v1 python deploy/hf-spaces/app.py) against vLLM CPU. App ran and streamed correctly, but logged:

UserWarning: The parameters have been moved from the Blocks constructor to the launch() method in Gradio 6.0: theme.

Trivial fix: pass theme=gr.themes.Soft() to .launch() instead of gr.Blocks(...).

While there I also verified the include_usage token-counting path the user added in fix(hf-spaces): report chunk-level metrics... works against real vLLM: 3 SSE chunks for 4 completion tokens, TTFT 2075 ms (cold CPU), TPOT 14.1 ms.

3. fix(docker): install into base image python; skip redundant vllm reinstall

docker buildx build --platform linux/amd64 -f Dockerfile . failed at the uv pip install -c constraints/serve.txt vllm transformers step with a transient xformers==0.0.33.post1 download timeout.

Root cause: the old Dockerfile created a second venv via uv sync that didn't include vLLM, then reinstalled vLLM into the venv from constraints — re-downloading the entire CUDA stack (xformers + nvidia-* wheels, ~3 GB). The reinstall is redundant: the base image vllm/vllm-openai:latest already has vLLM + its CUDA deps installed.

Fix: drop the second venv. Use uv pip install --system . to install Forge + its small project deps directly into the base image's Python, then uv pip install --system -c constraints/serve.txt transformers (~11 MB) to enforce the transformers pin.

Verified: docker buildx build --platform linux/amd64 -f Dockerfile . now completes cleanly, produces a 24.5 GB image (vs the previous timeout), and the transformers pin gets applied (5.8.1 → 4.57.6).

Other validations done in this pass

• Grafana dashboard auto-provisions: docker compose up -d prometheus grafana brings up both services; the Forge dashboard appears under "Forge" folder; the Prometheus datasource auto-wires. PromQL queries from the dashboard (vllm:num_requests_running, histogram_quantile(0.5, sum(rate(vllm:time_to_first_token_seconds_bucket[1m])) by (le))) resolve syntactically — no error annotations, just empty results because no vLLM traffic is hitting Prometheus yet. The user's fix(monitoring): move grafana dashboards mount off provisioning path works correctly.
• Local CI: 110 tests passing, lint + format + mypy clean.

What's still untested

Only Phase 7 (paid RunPod run) remains untested — that one requires actual GPU rental.