fix: install sofahutils in the image; drop CI token

The consolidation moved json_logger onto sofahutils, but the Dockerfile never
installed it -> the image would fail at import. Add the public install. CI drops
the token secret too.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: saibamo

.github/workflows/ci.yml

@@ -13,14 +13,12 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install dependencies
-        env:
-          SOFAH_GH_TOKEN: ${{ secrets.SOFAH_GH_TOKEN }}
         run: |
           python -m pip install --upgrade pip
           pip install pytest pytest-cov ruff bandit
           pip install flask pytz requests
-          # sofahutils is a private dependency; CI installs it with an org/repo token secret.
-          pip install "git+https://x-access-token:${SOFAH_GH_TOKEN}@github.com/sofahd/sofahutils.git"
+          # sofahutils (public repo, no token needed)
+          pip install "git+https://github.com/sofahd/sofahutils.git"
       - name: Lint (ruff, informational)
         run: ruff check .
         continue-on-error: true

Dockerfile

@@ -22,7 +22,8 @@ RUN apk --no-cache -U add \
     waitress \
     requests \
     cryptography \
-    pytz && \
+    pytz \
+    git+https://github.com/sofahd/sofahutils.git && \
     cd /home/api && \
     mkdir log_data && \
     chown api:api -R /home/api/*