ci: add forgejo actions pipeline with traefik labels and https health checks

backend/Dockerfile.prod

@@ -0,0 +1,34 @@
+FROM python:3.12-slim AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends libpq-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN pip install --no-cache-dir uv
+
+WORKDIR /app
+
+COPY pyproject.toml uv.lock ./
+RUN uv sync --no-dev --frozen
+
+COPY . .
+
+# ── Runtime ──────────────────────────────────────────────────────────────────
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends libpq-dev curl \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN pip install --no-cache-dir uv
+
+WORKDIR /app
+
+COPY --from=builder /app /app
+
+RUN chmod +x entrypoint.sh
+
+EXPOSE 5000
+
+HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=3 \
+  CMD curl -f http://localhost:5000/health || exit 1
+
+ENTRYPOINT ["./entrypoint.sh"]

backend/app/__init__.py

@@ -66,6 +66,15 @@ def create_app(config_name: str | None = None) -> Flask:
     app.register_blueprint(agents_public_bp)
     app.register_blueprint(agents_admin_bp)
 
+    @app.route("/health")
+    def health():
+        from flask import jsonify
+        try:
+            db.session.execute(db.text("SELECT 1"))
+            return jsonify({"status": "ok", "db": "ok"}), 200
+        except Exception as e:
+            return jsonify({"status": "error", "db": str(e)}), 503
+
     @app.before_request
     def track_page_view():
         from flask import request as req