fix(stack): bring-up fixes from first local deployment

- traefik pin v3.3 -> v3.6: v3.3's old docker client fails against
  Engine 29 socket proxy (empty daemon errors, no routers)
- backend/minio/chatbot/umami: traefik.docker.network hint — Traefik
  picked the internal-network IP for multi-network services and replies
  were hairpin-dropped (all backend routes hung)
- db-init: psql needs an explicit -d arameshplaza (no default db 'aramesh'),
  set -e so failures actually fail; one-shot folded-YAML needs semicolons
- chatbot image: drop g++ (apt unreachable in build network; all wheels
  prebuilt) and mkdir /data before chown (VOLUME does not create it)
- frontend image: create caddy user (alpine image has none) with writable
  /config and /data
- monitoring: blackbox probes replace raw metric scrapes of JSON/HTML
  health endpoints (they reported 'down' while healthy); blackbox joins
  edge; SITE_URL passed via env (Prometheus has no ${VAR:-default}
  expansion); ContainerMemoryNearLimit PromQL fixed (comparison inside
  label braces); HostDiskAlmostFull filters WSL/Docker-Desktop
  pseudo-mounts
- alertmanager: config rendered by stack.sh (no env expansion in AM) and
  delivered to Bale (tapi.bale.ai); stack.sh monitoring command
- machine-local override: minio console/API moved to 29001/29000

docker-compose.yml

@@ -19,7 +19,9 @@ services:
   # نقطه ورود واحد — مسیریابی / (سایت استاتیک)، /api (بک‌اند)، /media (MinIO)،
   # /chat (چت‌بات)، / (آنالیتیکس روی analytics.localhost — پایین همین فایل)
   traefik:
-    image: traefik:v3.3
+    # v3.3+ قدیمی‌ترین کلاینت داکر را دارد که با Engineهای جدید (API 1.5x) مشکل دارد —
+    # با v3.6 پین شده است
+    image: traefik:v3.6
     restart: unless-stopped
     logging: *default-logging
     command:
@@ -96,6 +98,8 @@ services:
       - "19000:9000"
     labels:
       - traefik.enable=true
+      # Traefik باید IP لبه را بگیرد — سرویس روی دو شبکه است
+      - traefik.docker.network=aramesh-backend_edge
       - traefik.http.routers.media.rule=PathPrefix(`/media`)
       - traefik.http.routers.media.entrypoints=web
       - traefik.http.routers.media.priority=100
@@ -154,9 +158,11 @@ services:
     logging: *default-logging
     entrypoint: >
       /bin/sh -c "
+      set -e;
       for DBN in umami aramesh_chatbot; do
-        psql -tAc \"SELECT 1 FROM pg_database WHERE datname='$$DBN'\" | grep -q 1 ||
-        psql -c \"CREATE DATABASE $$DBN\";
+        if ! psql -d arameshplaza -tAc \"SELECT 1 FROM pg_database WHERE datname='$$DBN'\" | grep -q 1; then
+          psql -d arameshplaza -c \"CREATE DATABASE $$DBN\";
+        fi;
         echo \"db-init: $$DBN ready\";
       done
       "
@@ -198,6 +204,8 @@ services:
       start_period: 20s
     labels:
       - traefik.enable=true
+      # Traefik باید IP لبه را بگیرد — سرویس روی دو شبکه است
+      - traefik.docker.network=aramesh-backend_edge
       - traefik.http.routers.api.rule=PathPrefix(`/api`)
       - traefik.http.routers.api.entrypoints=web
       - traefik.http.routers.api.priority=100
@@ -268,6 +276,8 @@ services:
         condition: service_completed_successfully
     labels:
       - traefik.enable=true
+      # Traefik باید IP لبه را بگیرد — سرویس روی دو شبکه است
+      - traefik.docker.network=aramesh-backend_edge
       - traefik.http.routers.chat.rule=PathPrefix(`/chat`)
       - traefik.http.routers.chat.entrypoints=web
       - traefik.http.routers.chat.priority=100
@@ -303,6 +313,8 @@ services:
       start_period: 60s
     labels:
       - traefik.enable=true
+      # Traefik باید IP لبه را بگیرد — سرویس روی دو شبکه است
+      - traefik.docker.network=aramesh-backend_edge
       - traefik.http.routers.analytics.rule=Host(`analytics.localhost`)
       - traefik.http.routers.analytics.entrypoints=web
       - traefik.http.services.analytics.loadbalancer.server.port=3000