Fix Dockerfile static copy, dynamic port, health endpoint

- Remove COPY static/ (runtime uploads live in DATA_DIR/uploads)
- Add /health endpoint
- Read PORT from env (NOMAD_PORT_http in production, 9756 local)
- citti.nomad: dynamic port, canary deploy, Consul/Traefik, health check

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -1,19 +1,33 @@
 FROM python:3.12-slim
 
+ARG BUILD_VERSION=unknown
+ARG BUILD_TIME=unknown
+ARG GIT_COMMIT=unknown
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    FLASK_APP=app.py \
+    FLASK_ENV=production \
+    BUILD_VERSION=${BUILD_VERSION} \
+    BUILD_TIME=${BUILD_TIME} \
+    GIT_COMMIT=${GIT_COMMIT}
+
 WORKDIR /app
 
-COPY requirements.txt .
+RUN pip install --upgrade --no-cache-dir pip
+
+COPY requirements.txt ./
 RUN pip install --no-cache-dir -r requirements.txt
 
 COPY app.py .
 COPY templates/ templates/
-COPY static/ static/
 
-ENV DATA_DIR=/data
-VOLUME ["/data"]
+ENV DATA_DIR=/app/instance \
+    PORT=9756 \
+    HOST=0.0.0.0
+
+RUN mkdir -p /app/instance
+
 EXPOSE 9756
 
-RUN useradd -m appuser && chown -R appuser /app
-USER appuser
-
-CMD ["python", "app.py"]
+CMD ["sh", "-c", "python app.py"]