Fix L2 deployment: healthcheck, DB deadlock, CI image resolution

- Add /health endpoint (returns 200, skips auth middleware)
- Healthcheck now hits /health instead of / (which 302s to OAuth)
- Advisory lock in db.init_pool() prevents deadlock when 4 uvicorn
  workers race to run schema DDL
- CI: --resolve-image always on docker stack deploy to force re-pull

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

l2/app/__init__.py

@@ -160,6 +160,11 @@ def create_app() -> FastAPI:
     template_dir = Path(__file__).parent / "templates"
     app.state.templates = create_jinja_env(template_dir)
 
+    # Health check (skips auth middleware via _SKIP_PREFIXES)
+    @app.get("/health")
+    async def health():
+        return JSONResponse({"status": "ok"})
+
     # Custom 404 handler
     @app.exception_handler(404)
     async def not_found_handler(request: Request, exc):