fix: persist workspace Python environments

docs/security.md

@@ -8,7 +8,9 @@ internal Compose network.
 Open WebUI forwards a short-lived HS256 user JWT. Runtime and Gateway verify
 the signature, issuer, expiry, and subject. They also require independent
 service bearer keys, so a copied user identity token alone cannot call either
-service.
+service. Runtime verifies the public request once, then re-signs the already
+verified identity with a fresh short-lived token for every Gateway call. Long
+Agent runs therefore do not reuse an expired request token.
 
 The browser never receives:
 
@@ -25,6 +27,8 @@ SHA-256 hash of the immutable Open WebUI user ID. Containers:
 
 - run as UID/GID 1000;
 - have a read-only root filesystem and writable `/workspace` volume;
+- keep Python virtual environments and user package/cache state under the
+  persistent `/workspace` volume;
 - use a dedicated per-user bridge network when egress is enabled;
 - drop every Linux capability;
 - enable `no-new-privileges`;