Add post-deploy health gate to staging (#5)

.gitea/workflows/deploy-staging.yml

@@ -43,6 +43,28 @@ jobs:
             up -d --build
           docker compose -p inboxintel-staging ps
 
-      - name: Staging endpoints
+      - name: Verify staging health
         shell: powershell
-        run: Write-Host "Staging up - Frontend http://localhost:18081  API http://localhost:18080/swagger"
+        # 'up -d' returns as soon as containers START, so a container that crashes
+        # on boot (e.g. bad DB password) would still report success. Poll the actual
+        # endpoints and fail the job if either isn't serving, dumping api logs so the
+        # cause is visible in the run. ASCII only (Windows PowerShell reads .ps1 as ANSI).
+        run: |
+          $ok = $false
+          foreach ($i in 1..20) {
+            Start-Sleep -Seconds 3
+            try { Invoke-WebRequest "http://localhost:18081/" -UseBasicParsing -TimeoutSec 5 | Out-Null; $fe = 200 }
+            catch { $fe = 0 }
+            # A 401 from the api means it is serving (auth enforced); Invoke-WebRequest
+            # throws on non-2xx, so read the status code off the exception.
+            try { Invoke-WebRequest "http://localhost:18080/api/v1/auth/me" -UseBasicParsing -TimeoutSec 5 | Out-Null; $api = 200 }
+            catch { $api = $_.Exception.Response.StatusCode.value__; if (-not $api) { $api = 0 } }
+            Write-Host "attempt $i - frontend=$fe api=$api"
+            if ($fe -eq 200 -and $api -gt 0) { $ok = $true; break }
+          }
+          if (-not $ok) {
+            Write-Host "Staging health check FAILED. Last 40 api log lines:"
+            docker logs inboxintel-staging-api-1 --tail 40
+            exit 1
+          }
+          Write-Host "Staging healthy - Frontend http://localhost:18081  API http://localhost:18080"