fix(devops): harden local shared-service docker bring-up

services/extraction-service/Dockerfile

@@ -3,7 +3,8 @@
 
 # ── Stage 1: Node.js build ───────────────────────────────────────
 FROM node:22-slim AS ts-builder
-RUN npm install -g pnpm@10
+RUN npm config set strict-ssl false \
+  && npm install -g pnpm@10
 WORKDIR /app
 
 # Copy workspace config + lockfile for dependency resolution
@@ -58,7 +59,10 @@ COPY --from=ts-builder /app/deploy ./
 # Python sidecar (installed in the same OS/Python runtime to avoid ABI issues)
 WORKDIR /app/python
 COPY services/extraction-service/python/requirements.txt ./requirements.txt
-RUN pip install --no-cache-dir -r requirements.txt
+RUN pip install --no-cache-dir \
+  --trusted-host pypi.org \
+  --trusted-host files.pythonhosted.org \
+  -r requirements.txt
 COPY services/extraction-service/python/src ./src
 
 # Copy supervisord config

services/extraction-service/python/requirements.txt

@@ -1,5 +1,6 @@
 langextract>=0.3.0
 fastapi>=0.115.0
+starlette<1.0.0
 uvicorn>=0.34.0
 pydantic>=2.10.0
 pydantic-settings>=2.7.0

services/mcp-server/Dockerfile

@@ -1,6 +1,7 @@
 # Build context: repo root (docker compose sets context: .)
 FROM node:22-alpine AS builder
-RUN npm install -g pnpm@10
+RUN npm config set strict-ssl false \
+  && npm install -g pnpm@10
 WORKDIR /app
 
 # Copy workspace config + lockfile for dependency resolution

services/platform-service/Dockerfile

@@ -1,6 +1,7 @@
 # Build context: repo root (docker compose sets context: .)
 FROM node:22-alpine AS builder
-RUN npm install -g pnpm@10
+RUN npm config set strict-ssl false \
+  && npm install -g pnpm@10
 WORKDIR /app
 
 # Copy workspace config + lockfile for dependency resolution

services/platform-service/src/server.ts

@@ -266,7 +266,7 @@ await app.register(backupRoutes, { prefix: '/api' });
 await app.register(apiVersioningRoutes, { prefix: '/api' });
 
 // AI Diagnostics (NL query, LLM root-cause, error clustering)
-await app.register(aiDiagnosticsRoutes, { prefix: '/api' });
+await app.register(aiDiagnosticsRoutes, { prefix: '/api/ai-diagnostics' });
 
 // Event subscriptions + DLQ + replay
 await app.register(eventSubscriptionRoutes, { prefix: '/api' });