Fix build cache, DNS/model download, and AI Edit error handling

Build / pip layer fixes:
- Add BUILDID ARG to Dockerfile.gpu; pass from docker-compose.gpu.yml build args
  so pip layers can be force-busted without --no-cache:
    BUILDID=$(date +%s) docker compose -f docker-compose.gpu.yml up --build

Model download (DNS-blocked environments):
- Change HF model cache from named volume to ./data/hf_cache bind mount
  so models can be pre-downloaded on the host (no rebuild needed)
- Remove now-unused hf_model_cache named volume
- README: add iptables fix + huggingface-cli offline download instructions

Error handling improvements:
- ai_edit_region: catch ConnectError/Errno-3 → return 503 with exact fix commands
- _require_remote: give actionable message when local_gpu provider fails to load
- _build_provider: catch AttributeError (torch.xpu from wrong diffusers) not just ImportError
- local_diffusion.py: fix docstring to reflect <0.29.0 pin

https://claude.ai/code/session_01WVDg7amsy1TTtxvpku7bcM

README.md

@@ -57,6 +57,12 @@ docker compose -f docker-compose.gpu.yml up -d --build
 docker compose up -d --build
 ```
 
+If pip packages seem stale after a pull (e.g., wrong diffusers version), force a pip layer rebuild without re-downloading the entire PyTorch base image:
+
+```bash
+BUILDID=$(date +%s) docker compose -f docker-compose.gpu.yml up -d --build
+```
+
 ---
 
 ## AI Providers
@@ -202,6 +208,33 @@ docker compose -f docker-compose.gpu.yml logs | grep -i sam
 
 If Docker created `./data/` as root and you can't write there without `sudo`, you can also use root's curl as above — the container reads the file regardless of owner.
 
+**AI Edit returns "model files not yet downloaded" or "Errno -3 / DNS" error**
+
+The container's DNS is blocked (common on corporate networks or custom iptables rules), so it can't download SDXL models from HuggingFace. Two options:
+
+*Option A — fix Docker DNS (recommended, one command):*
+```bash
+sudo iptables -I DOCKER-USER -p udp --dport 53 -j ACCEPT
+docker compose -f docker-compose.gpu.yml restart
+```
+
+*Option B — pre-download models on the host (if iptables fix isn't possible):*
+```bash
+pip install huggingface-hub
+
+# Download the inpainting model (~6.5 GB, needed for AI Edit):
+huggingface-cli download diffusers/stable-diffusion-xl-1.0-inpainting-0.1 \
+  --cache-dir ./data/hf_cache \
+  --exclude "*.msgpack" "flax_*" "tf_*"
+
+# Download the text-to-image model (~6.5 GB, needed for Text → Image):
+huggingface-cli download stabilityai/stable-diffusion-xl-base-1.0 \
+  --cache-dir ./data/hf_cache \
+  --exclude "*.msgpack" "flax_*" "tf_*"
+```
+
+The models land in `./data/hf_cache/` which is bind-mounted into the container — no rebuild needed. Restart the container and the first AI Edit request loads from local disk.
+
 **Out of VRAM during generation**
 - Reduce `LOCAL_GPU_MAX_PIPELINES=1` in `.env` (default 2)
 - Or override to a smaller model: `HF_MODEL_TXT2IMG=runwayml/stable-diffusion-v1-5`