Add healthcheck and start-first update for l2-server

Zero-downtime deploys: new container starts and passes health
check before the old one is stopped. Caddy always has a healthy
backend to proxy to.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -49,6 +49,12 @@ services:
       - IPFS_API=/dns/ipfs/tcp/5001
       - ANCHOR_BACKUP_DIR=/data/anchors
       # DATABASE_URL, ARTDAG_DOMAIN, ARTDAG_USER, JWT_SECRET from .env file
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8200/')"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
     volumes:
       - l2_data:/data/l2  # Still needed for RSA keys
       - anchor_backup:/data/anchors  # Persistent anchor proofs (survives DB wipes)
@@ -60,6 +66,8 @@ services:
       - ipfs
     deploy:
       replicas: 1
+      update_config:
+        order: start-first
       restart_policy:
         condition: on-failure
       placement: