Merge staging into production: drop the throwaway rebuild comment

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpTYCBLH58XzrM7n3xPJ5N

.gitea/workflows/build.yml

@@ -108,6 +108,25 @@ jobs:
         run: |
           docker push "${REGISTRY_HOST}/${PAGE_FETCHER_API_IMAGE}:${IMAGE_TAG}"
 
+      # Watchtower's poll is the fallback, not the mechanism: 30s on staging but 300s on
+      # production, so without this a green run can sit five minutes ahead of the deploy it
+      # claims to have made. Copied from easyDent, including the soft failure -- an unset
+      # secret or an unreachable API must degrade to the poll, never fail the build.
+      - name: Trigger Watchtower redeploy
+        env:
+          URL_STAGING: ${{ secrets.WATCHTOWER_URL_STAGING }}
+          URL_PRODUCTION: ${{ secrets.WATCHTOWER_URL_PRODUCTION }}
+          TOKEN: ${{ secrets.WATCHTOWER_TOKEN }}
+        run: |
+          if [ "${IMAGE_TAG}" = "production" ]; then URL="${URL_PRODUCTION}"; else URL="${URL_STAGING}"; fi
+          if [ -n "${URL}" ] && [ -n "${TOKEN}" ]; then
+            echo "Triggering Watchtower at ${URL}"
+            curl -sf -m 30 -H "Authorization: Bearer ${TOKEN}" "${URL}" && echo "  -> redeploy triggered" \
+              || echo "  -> trigger failed; Watchtower will still pick it up on the next poll"
+          else
+            echo "Watchtower push-trigger not configured (WATCHTOWER_* secrets unset); relying on the poll interval."
+          fi
+
       - name: Reclaim disk space (keep recent build cache)
         if: always()
         run: |
@@ -169,10 +188,15 @@ jobs:
             staging)    HOST=192.168.1.111 ;;
             production) HOST=192.168.1.101 ;;
           esac
+          # `-L` follows redirects and we assert on the FINAL code, because a 302 from `/`
+          # is a healthy answer for a site running in UnderConstruction mode -- it means the
+          # app is up and routing. Asserting a bare 200 failed jecreativ.ro's first
+          # production deploy for doing exactly what it was configured to do.
+          #
           # `|| CODE=000` for the same reason as above: curl exiting non-zero on a
           # connection failure must produce a reportable code, not kill the step before
           # it can say what went wrong. (`-s` without `-f` already tolerates 4xx/5xx.)
-          CODE=$(curl -s -o /dev/null -w '%{http_code}' -m 20 "http://${HOST}:${WEB_PORT}/") || CODE=000
+          CODE=$(curl -sL -o /dev/null -w '%{http_code}' -m 20 "http://${HOST}:${WEB_PORT}/") || CODE=000
           if [ "${CODE}" != "200" ]; then
             echo "::error::Home page returned ${CODE}."
             exit 1