Fix L2 deployment: healthcheck, DB deadlock, CI image resolution

- Add /health endpoint (returns 200, skips auth middleware)
- Healthcheck now hits /health instead of / (which 302s to OAuth)
- Advisory lock in db.init_pool() prevents deadlock when 4 uvicorn
  workers race to run schema DDL
- CI: --resolve-image always on docker stack deploy to force re-pull

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -96,13 +96,13 @@ jobs:
               echo 'Skipping L2 (no changes)'
             fi
 
-            # Deploy stacks
+            # Deploy stacks (--resolve-image always forces re-pull of :latest)
             if [ \"\$BUILD_L1\" = true ]; then
-              cd l1 && source .env && docker stack deploy -c docker-compose.yml celery && cd ..
+              cd l1 && source .env && docker stack deploy --resolve-image always -c docker-compose.yml celery && cd ..
               echo 'L1 stack deployed'
             fi
             if [ \"\$BUILD_L2\" = true ]; then
-              cd l2 && source .env && docker stack deploy -c docker-compose.yml activitypub && cd ..
+              cd l2 && source .env && docker stack deploy --resolve-image always -c docker-compose.yml activitypub && cd ..
               echo 'L2 stack deployed'
             fi