fix(stack): bring-up fixes from first local deployment

- traefik pin v3.3 -> v3.6: v3.3's old docker client fails against
  Engine 29 socket proxy (empty daemon errors, no routers)
- backend/minio/chatbot/umami: traefik.docker.network hint — Traefik
  picked the internal-network IP for multi-network services and replies
  were hairpin-dropped (all backend routes hung)
- db-init: psql needs an explicit -d arameshplaza (no default db 'aramesh'),
  set -e so failures actually fail; one-shot folded-YAML needs semicolons
- chatbot image: drop g++ (apt unreachable in build network; all wheels
  prebuilt) and mkdir /data before chown (VOLUME does not create it)
- frontend image: create caddy user (alpine image has none) with writable
  /config and /data
- monitoring: blackbox probes replace raw metric scrapes of JSON/HTML
  health endpoints (they reported 'down' while healthy); blackbox joins
  edge; SITE_URL passed via env (Prometheus has no ${VAR:-default}
  expansion); ContainerMemoryNearLimit PromQL fixed (comparison inside
  label braces); HostDiskAlmostFull filters WSL/Docker-Desktop
  pseudo-mounts
- alertmanager: config rendered by stack.sh (no env expansion in AM) and
  delivered to Bale (tapi.bale.ai); stack.sh monitoring command
- machine-local override: minio console/API moved to 29001/29000

monitoring/prometheus/alerts.yml

@@ -5,6 +5,7 @@ groups:
   - name: aramesh-availability
     rules:
       - alert: ServiceDown
+        # سرویس‌های دارای متریک (backend/traefik/exporters) — بقیه با ProbeFailing پوشش می‌شوند
         expr: up == 0
         for: 2m
         labels:
@@ -13,6 +14,15 @@ groups:
           summary: "{{ $labels.job }} پاسخ نمی‌دهد"
           description: "سرویس {{ $labels.job }} ({{ $labels.instance }}) حداقل ۲ دقیقه پایین است."
 
+      - alert: ProbeFailing
+        expr: probe_success == 0
+        for: 2m
+        labels:
+          severity: critical
+        annotations:
+          summary: "پروب {{ $labels.job }} ناموفق است"
+          description: "سرویسِ پشت پروب {{ $labels.instance }} حداقل ۲ دقیقه پاسخ نمی‌دهد."
+
       - alert: BackendHealthFailing
         expr: probe_success{job="blackbox-internal-health"} == 0
         for: 2m
@@ -34,8 +44,9 @@ groups:
   - name: aramesh-resources
     rules:
       - alert: HostDiskAlmostFull
+        # Docker Desktop/WSL سوارهای تکراری می‌سازد — فقط مسیرهای واقعی دیده می‌شوند
         expr: |
-          1 - (node_filesystem_avail_bytes{fstype!~"tmpfs|overlay|squashfs"} / node_filesystem_size_bytes{fstype!~"tmpfs|overlay|squashfs"}) > 0.85
+          1 - (node_filesystem_avail_bytes{fstype!~"tmpfs|overlay|squashfs", mountpoint!~"/run/desktop.*|/parent-distro.*|/usr/lib/wsl.*|/mnt/wsl.*"} / node_filesystem_size_bytes{fstype!~"tmpfs|overlay|squashfs", mountpoint!~"/run/desktop.*|/parent-distro.*|/usr/lib/wsl.*|/mnt/wsl.*"}) > 0.85
         for: 5m
         labels:
           severity: warning
@@ -54,8 +65,9 @@ groups:
 
       - alert: ContainerMemoryNearLimit
         expr: |
-          container_memory_usage_bytes{image!="", container!="", container_spec_memory_limit_bytes > 0}
-            / container_spec_memory_limit_bytes{container!="", container_spec_memory_limit_bytes > 0} > 0.9
+          (container_memory_usage_bytes{image!="", container!=""}
+            / container_spec_memory_limit_bytes{image!="", container!=""} > 0.9)
+          and (container_spec_memory_limit_bytes{image!="", container!=""} > 0)
         for: 10m
         labels:
           severity: warning