Split the pip install into multiple Dockerfile layers

The combined pip install layer was already over Cloudflare's
single-blob/layer payload-size limit (~113MB unpacked) before any
recent change -- the last two build-and-push CI runs were failing on
it. Isolate the three largest packages (sqlalchemy, pillow, pypdfium2)
into their own layers, same fix already applied to render-service's
npm installs below for the same limit.

server/Dockerfile

@@ -37,6 +37,22 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 COPY requirements.txt .
+# Split across several layers rather than one `pip install -r
+# requirements.txt` -- same Cloudflare single-blob/layer payload-size
+# limit as render-service's npm installs below. The single combined
+# layer was measured at ~113MB unpacked, over the limit on its own.
+# Isolating the three largest packages gets every layer's unpacked size
+# well clear of 100MB (sqlalchemy ~15MB, pillow ~19MB, pypdfium2 ~8MB,
+# the remaining `-r requirements.txt` layer ~71MB). Each package
+# version here still comes from requirements.txt (`pip install -r` for
+# everything that doesn't need its own layer skips these three, since
+# pip sees them already satisfied); the explicit versions below just
+# control *when* each installs -- same "single source of truth, just
+# splitting *when* it installs" tradeoff as the npm section's --no-save
+# comment below.
+RUN pip install --no-cache-dir sqlalchemy==2.0.51
+RUN pip install --no-cache-dir pillow==12.3.0
+RUN pip install --no-cache-dir pypdfium2==5.12.1
 RUN pip install --no-cache-dir -r requirements.txt
 
 # render-service/'s dependencies installed as several separate layers