fix: persist workspace Python environments

docs/operations.md

@@ -47,6 +47,12 @@ Compose file, image, repository, or log.
 The SSH override removes `/var/run/docker.sock` from Gateway and mounts the
 dedicated SSH directory read-only at `/root/.ssh`.
 
+The Workspace image keeps the user home, package caches, and Python user base
+under `/workspace/.agent`; the conventional project virtual environment is
+`/workspace/.venv`. Updating `WORKSPACE_IMAGE` to a new immutable tag causes
+Gateway to replace each stale workspace container on its next access while
+retaining the user's named data volume.
+
 ## Ollama model residency
 
 The NAS Ollama service keeps Luna, Terra, and Sol resident with:

docs/security.md

@@ -8,7 +8,9 @@ internal Compose network.
 Open WebUI forwards a short-lived HS256 user JWT. Runtime and Gateway verify
 the signature, issuer, expiry, and subject. They also require independent
 service bearer keys, so a copied user identity token alone cannot call either
-service.
+service. Runtime verifies the public request once, then re-signs the already
+verified identity with a fresh short-lived token for every Gateway call. Long
+Agent runs therefore do not reuse an expired request token.
 
 The browser never receives:
 
@@ -25,6 +27,8 @@ SHA-256 hash of the immutable Open WebUI user ID. Containers:
 
 - run as UID/GID 1000;
 - have a read-only root filesystem and writable `/workspace` volume;
+- keep Python virtual environments and user package/cache state under the
+  persistent `/workspace` volume;
 - use a dedicated per-user bridge network when egress is enabled;
 - drop every Linux capability;
 - enable `no-new-privileges`;