perf(klausur-service): split Dockerfile into base + app layer

Tesseract OCR + 70 Debian packages + pip dependencies are now in a
separate base image (klausur-base:latest) that is built once and reused.
A --no-cache build now only rebuilds the code layer (~seconds) instead
of re-downloading 33 MB of system packages (~9 minutes).

Rebuild base when requirements.txt or system deps change:
  docker build -f klausur-service/Dockerfile.base -t klausur-base:latest klausur-service/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

klausur-service/Dockerfile

@@ -8,24 +8,15 @@ RUN npm install
 COPY frontend/ ./
 RUN npm run build
 
-# Production stage
+# Production stage — uses pre-built base with Tesseract + Python deps.
-FROM python:3.11-slim
+# Base image contains: python:3.11-slim + tesseract-ocr + all pip packages.
+# Rebuild base only when requirements.txt or system deps change:
+#   docker build -f klausur-service/Dockerfile.base -t klausur-base:latest klausur-service/
+FROM klausur-base:latest
 
 WORKDIR /app
 
-# Install system dependencies (incl. Tesseract OCR for bounding-box extraction)
+# Copy backend code (this is the only layer that changes on code edits)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    tesseract-ocr \
-    tesseract-ocr-deu \
-    tesseract-ocr-eng \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install Python dependencies
-COPY backend/requirements.txt ./
-RUN pip install --no-cache-dir -r requirements.txt
-
-# Copy backend code
 COPY backend/ ./
 
 # Copy built frontend to the expected path

klausur-service/Dockerfile.base

@@ -0,0 +1,24 @@
+# Base image with system dependencies + Python packages.
+# These change rarely — build once, reuse on every --no-cache.
+#
+# Rebuild manually when requirements.txt or system deps change:
+#   docker build -f klausur-service/Dockerfile.base -t klausur-base:latest klausur-service/
+#
+FROM python:3.11-slim
+
+WORKDIR /app
+
+# System dependencies (Tesseract OCR, curl for healthcheck)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl \
+    tesseract-ocr \
+    tesseract-ocr-deu \
+    tesseract-ocr-eng \
+    && rm -rf /var/lib/apt/lists/*
+
+# Python dependencies
+COPY backend/requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Clean up pip cache
+RUN rm -rf /root/.cache/pip