Fix Dockerfile static copy, dynamic port, health endpoint

- Remove COPY static/ (runtime uploads live in DATA_DIR/uploads)
- Add /health endpoint
- Read PORT from env (NOMAD_PORT_http in production, 9756 local)
- citti.nomad: dynamic port, canary deploy, Consul/Traefik, health check

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

citti.nomad

@@ -1,50 +1,102 @@
 job "citti" {
+  region      = "global"
   datacenters = ["dc1"]
   type        = "service"
 
+  update {
+    stagger           = "30s"
+    max_parallel      = 1
+    canary            = 1
+    min_healthy_time  = "10s"
+    healthy_deadline  = "5m"
+    auto_revert       = true
+    auto_promote      = true
+    progress_deadline = "10m"
+  }
+
   group "app" {
     count = 1
 
-    volume "citti-data" {
-      type      = "host"
-      read_only = false
-      source    = "citti-data"
+    network {
+      port "http" {}
     }
 
-    network {
-      port "http" {
-        static = 9756
+    reschedule {
+      attempts       = 5
+      interval       = "10m"
+      delay          = "30s"
+      delay_function = "exponential"
+      max_delay      = "120s"
+      unlimited      = false
+    }
+
+    volume "citti-data" {
+      type      = "host"
+      source    = "citti-data"
+      read_only = false
+    }
+
+    service {
+      provider = "consul"
+      name     = "citti"
+      port     = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.citti.rule=Host(`citti.i80.dk`)",
+        "traefik.http.routers.citti.tls=true",
+      ]
+
+      canary_tags = [
+        "traefik.enable=false",
+      ]
+
+      check {
+        name     = "http_health_check"
+        type     = "http"
+        path     = "/health"
+        interval = "10s"
+        timeout  = "5s"
+
+        check_restart {
+          limit = 3
+          grace = "10s"
+        }
       }
     }
 
     task "web" {
       driver = "docker"
 
+      volume_mount {
+        volume      = "citti-data"
+        destination = "/app/instance"
+        read_only   = false
+      }
+
       config {
         image      = "registry.i80.dk/gitea/citti:latest"
         ports      = ["http"]
         force_pull = true
       }
 
-      volume_mount {
-        volume      = "citti-data"
-        destination = "/data"
-        read_only   = false
+      restart {
+        attempts = 10
+        interval = "10m"
+        delay    = "10s"
+        mode     = "fail"
       }
 
       env {
-        DATA_DIR = "/data"
+        DATA_DIR = "/app/instance"
+        PORT     = "${NOMAD_PORT_http}"
+        HOST     = "0.0.0.0"
       }
 
       resources {
         cpu    = 200
         memory = 256
       }
-
-      service {
-        name = "citti"
-        port = "http"
-      }
     }
   }
 }