gateway Dockerfile: merge the two RUN layers into one (Sonar)

The pip-install and useradd both run as root before the USER switch, so there's
no reason for two image layers. Combine them with `&&`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: OriNachum

model_gear/templates/fleet/Dockerfile.gateway

@@ -10,10 +10,11 @@
 # run ahead of a PyPI release set it to a published TestPyPI `.devN` build.
 FROM python:3.12-slim
 ARG MODEL_GEAR_VERSION
-RUN pip install --no-cache-dir "model-gear==${MODEL_GEAR_VERSION}"
-# Run as a non-root user — the gateway only binds :8000 and makes outbound HTTP
-# calls to the backends on the compose network; it needs no elevated privileges.
-RUN useradd --create-home --uid 10001 gateway
+# One layer: install model-gear (system-wide, as root) and create the unprivileged
+# runtime user. The gateway only binds :8000 and makes outbound HTTP calls to the
+# backends on the compose network, so it needs no elevated privileges.
+RUN pip install --no-cache-dir "model-gear==${MODEL_GEAR_VERSION}" \
+    && useradd --create-home --uid 10001 gateway
 USER gateway
 EXPOSE 8000
 ENTRYPOINT ["python", "-m", "model_gear.gateway"]