fix(stack): bring-up fixes from first local deployment

- traefik pin v3.3 -> v3.6: v3.3's old docker client fails against
  Engine 29 socket proxy (empty daemon errors, no routers)
- backend/minio/chatbot/umami: traefik.docker.network hint — Traefik
  picked the internal-network IP for multi-network services and replies
  were hairpin-dropped (all backend routes hung)
- db-init: psql needs an explicit -d arameshplaza (no default db 'aramesh'),
  set -e so failures actually fail; one-shot folded-YAML needs semicolons
- chatbot image: drop g++ (apt unreachable in build network; all wheels
  prebuilt) and mkdir /data before chown (VOLUME does not create it)
- frontend image: create caddy user (alpine image has none) with writable
  /config and /data
- monitoring: blackbox probes replace raw metric scrapes of JSON/HTML
  health endpoints (they reported 'down' while healthy); blackbox joins
  edge; SITE_URL passed via env (Prometheus has no ${VAR:-default}
  expansion); ContainerMemoryNearLimit PromQL fixed (comparison inside
  label braces); HostDiskAlmostFull filters WSL/Docker-Desktop
  pseudo-mounts
- alertmanager: config rendered by stack.sh (no env expansion in AM) and
  delivered to Bale (tapi.bale.ai); stack.sh monitoring command
- machine-local override: minio console/API moved to 29001/29000

chatbot/Dockerfile

@@ -3,11 +3,8 @@ FROM python:3.11-slim
 
 WORKDIR /srv
 
-# وابستگی‌های سیستمی برای numpy/scikit-learn
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    g++ \
-    && rm -rf /var/lib/apt/lists/*
-
+# همهٔ وابستگی‌های سنگین (numpy/scikit-learn/torch/psycopg) ویل prebuilt دارند —
+# بدون کامپایلر؛ دسترسی apt در شبکهٔ بیلد قابل‌اعتماد نیست
 COPY requirements.txt /srv/chatbot/requirements.txt
 RUN pip install --no-cache-dir -r /srv/chatbot/requirements.txt
 
@@ -20,6 +17,7 @@ VOLUME /data
 
 # کاربر بدون دسترسی root — فقط /data باید نوشتنی باشد (کش مدل‌ها)
 RUN useradd --system --create-home appuser \
+    && mkdir -p /data \
     && chown -R appuser:appuser /srv/chatbot /data
 USER appuser