fix(deploy): widen health-check window past the truth-layer cold start (#321)

The #318/#320 image starts healthy but the deploy's health check gave up
before gunicorn bound :8000, taking prod down on a false negative.

entrypoint.sh builds the XBRL truth-layer DuckDB store BEFORE gunicorn forks
(~45s observed on the droplet), on top of collectstatic + Playwright verify.
The old check waited `sleep 30` + 3x5s (~45s) then failed -- and the journal
shows all 3 probes (08:26:16/:22/:27) ran BEFORE gunicorn even listened
(08:26:30). The container was fine; the window just raced the store build.

Widen to `sleep 10` + 24x5s (~130s, ~2.8x the measured cold start) and
succeed as soon as /health/ answers. Also dump `journalctl -n 80` on failure
so future startup regressions are diagnosable from the deploy log directly.

Not touching gunicorn: the "Control server error: Permission denied" (gunicorn
25.x control socket defaulting to /app/gunicorn.ctl under the root-owned CWD)
is non-fatal -- f86604d ran the identical gunicorn/config/user and served
fine. Silencing that control socket is a separate, lower-priority follow-up.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: FlyM1ss

.github/workflows/backend-deploy.yml

@@ -220,20 +220,28 @@ jobs:
               exit 1
             }
 
-            echo "Waiting 30s for service to start..."
-            sleep 30
-
-            echo "Checking health endpoint..."
-            for i in 1 2 3; do
+            # Cold start is dominated by entrypoint.sh building the XBRL truth-layer
+            # DuckDB store BEFORE gunicorn forks (~45s observed), on top of collectstatic
+            # + Playwright verification. `systemctl is-active` only proves the container
+            # launched, not that gunicorn is listening -- so poll /health/ across a window
+            # comfortably above the measured cold start (~130s) instead of a fixed ~45s
+            # wait, which raced the store build and failed the deploy even though the
+            # container was healthy. Succeeds as soon as the endpoint answers.
+            echo "Waiting 10s before first health probe..."
+            sleep 10
+
+            echo "Checking health endpoint (up to ~130s for cold start)..."
+            for i in $(seq 1 24); do
               if curl -sf -m 10 http://localhost:8000/health/; then
                 echo ""
-                echo "Deployment verification successful!"
+                echo "Deployment verification successful (attempt $i)!"
                 exit 0
               fi
-              echo "Attempt $i/3 failed, retrying in 5s..."
+              echo "Attempt $i/24 failed, retrying in 5s..."
               sleep 5
             done
 
             echo "ERROR: Health check failed"
             systemctl --user status "$SYSTEMD_UNIT" || true
+            journalctl --user -u "$SYSTEMD_UNIT" --no-pager -n 80 || true
             exit 1