ci(staging): add post-deploy health gate

'docker compose up -d' returns once containers start, so a container that
crashes on boot (as the api did on the DB password mismatch) still reported
success. Poll the frontend and api endpoints after deploy and fail the job,
dumping api logs, if either isn't serving within ~60s. ASCII only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy-staging.yml

@@ -43,6 +43,28 @@ jobs:
             up -d --build
           docker compose -p inboxintel-staging ps
 
-      - name: Staging endpoints
+      - name: Verify staging health
         shell: powershell
-        run: Write-Host "Staging up - Frontend http://localhost:18081  API http://localhost:18080/swagger"
+        # 'up -d' returns as soon as containers START, so a container that crashes
+        # on boot (e.g. bad DB password) would still report success. Poll the actual
+        # endpoints and fail the job if either isn't serving, dumping api logs so the
+        # cause is visible in the run. ASCII only (Windows PowerShell reads .ps1 as ANSI).
+        run: |
+          $ok = $false
+          foreach ($i in 1..20) {
+            Start-Sleep -Seconds 3
+            try { Invoke-WebRequest "http://localhost:18081/" -UseBasicParsing -TimeoutSec 5 | Out-Null; $fe = 200 }
+            catch { $fe = 0 }
+            # A 401 from the api means it is serving (auth enforced); Invoke-WebRequest
+            # throws on non-2xx, so read the status code off the exception.
+            try { Invoke-WebRequest "http://localhost:18080/api/v1/auth/me" -UseBasicParsing -TimeoutSec 5 | Out-Null; $api = 200 }
+            catch { $api = $_.Exception.Response.StatusCode.value__; if (-not $api) { $api = 0 } }
+            Write-Host "attempt $i - frontend=$fe api=$api"
+            if ($fe -eq 200 -and $api -gt 0) { $ok = $true; break }
+          }
+          if (-not $ok) {
+            Write-Host "Staging health check FAILED. Last 40 api log lines:"
+            docker logs inboxintel-staging-api-1 --tail 40
+            exit 1
+          }
+          Write-Host "Staging healthy - Frontend http://localhost:18081  API http://localhost:18080"