fix(stack): bring-up fixes from first local deployment

- traefik pin v3.3 -> v3.6: v3.3's old docker client fails against
  Engine 29 socket proxy (empty daemon errors, no routers)
- backend/minio/chatbot/umami: traefik.docker.network hint — Traefik
  picked the internal-network IP for multi-network services and replies
  were hairpin-dropped (all backend routes hung)
- db-init: psql needs an explicit -d arameshplaza (no default db 'aramesh'),
  set -e so failures actually fail; one-shot folded-YAML needs semicolons
- chatbot image: drop g++ (apt unreachable in build network; all wheels
  prebuilt) and mkdir /data before chown (VOLUME does not create it)
- frontend image: create caddy user (alpine image has none) with writable
  /config and /data
- monitoring: blackbox probes replace raw metric scrapes of JSON/HTML
  health endpoints (they reported 'down' while healthy); blackbox joins
  edge; SITE_URL passed via env (Prometheus has no ${VAR:-default}
  expansion); ContainerMemoryNearLimit PromQL fixed (comparison inside
  label braces); HostDiskAlmostFull filters WSL/Docker-Desktop
  pseudo-mounts
- alertmanager: config rendered by stack.sh (no env expansion in AM) and
  delivered to Bale (tapi.bale.ai); stack.sh monitoring command
- machine-local override: minio console/API moved to 29001/29000

monitoring/prometheus/prometheus.yml

@@ -39,26 +39,49 @@ scrape_configs:
     static_configs:
       - targets: ["postgres-exporter:9187"]
 
-  # سلامت مستقیم سرویس‌ها — up == 0 یعنی آن سرویس پایین است
-  - job_name: frontend
-    metrics_path: /
+  # سلامت سرویس‌های بدون متریک — با پروب blackbox (پاسخ JSON/HTML قابل اسکرپ نیست)
+  # نتیجه: probe_success (۱ = سالم، ۰ = پایین) — هشدار ProbeFailing پوشش می‌دهد
+  - job_name: blackbox-frontend
+    metrics_path: /probe
+    params:
+      module: [http_2xx]
     static_configs:
-      - targets: ["frontend:80"]
+      - targets:
+          - http://frontend/
+    relabel_configs: &blackbox_relabel
+      - source_labels: [__address__]
+        target_label: __param_target
+      - source_labels: [__param_target]
+        target_label: instance
+      - target_label: __address__
+        replacement: blackbox-exporter:9115
 
-  - job_name: minio
-    metrics_path: /minio/health/live
+  - job_name: blackbox-minio
+    metrics_path: /probe
+    params:
+      module: [http_2xx]
     static_configs:
-      - targets: ["minio:9000"]
+      - targets:
+          - http://minio:9000/minio/health/live
+    relabel_configs: *blackbox_relabel
 
-  - job_name: umami
-    metrics_path: /api/heartbeat
+  - job_name: blackbox-umami
+    metrics_path: /probe
+    params:
+      module: [http_2xx]
     static_configs:
-      - targets: ["umami:3000"]
+      - targets:
+          - http://umami:3000/api/heartbeat
+    relabel_configs: *blackbox_relabel
 
-  - job_name: chatbot
-    metrics_path: /chat/healthz
+  - job_name: blackbox-chatbot
+    metrics_path: /probe
+    params:
+      module: [http_2xx]
     static_configs:
-      - targets: ["chatbot:8000"]
+      - targets:
+          - http://chatbot:8000/chat/healthz
+    relabel_configs: *blackbox_relabel
 
   # پروب بیرون‌نگر — سلامت واقعی /api/health (بخش عمق: DB و MinIO را می‌آزماید)
   # و در تولید، آدرس عمومی سایت (SITE_URL از .env — پشتیبانی متغیر محیطی Prometheus)
@@ -69,13 +92,7 @@ scrape_configs:
     static_configs:
       - targets:
           - http://backend:8000/api/health
-    relabel_configs: &blackbox_relabel
-      - source_labels: [__address__]
-        target_label: __param_target
-      - source_labels: [__param_target]
-        target_label: instance
-      - target_label: __address__
-        replacement: blackbox-exporter:9115
+    relabel_configs: *blackbox_relabel
 
   - job_name: blackbox-public
     metrics_path: /probe
@@ -83,5 +100,7 @@ scrape_configs:
       module: [http_2xx]
     static_configs:
       - targets:
-          - ${SITE_URL:-http://frontend/}
+          # مقدار پیش‌فرض در docker-compose.monitoring.yml تنظیم می‌شود
+          # (Prometheus سینتکس ${VAR:-default} را پشتیبانی نمی‌کند)
+          - ${SITE_URL}
     relabel_configs: *blackbox_relabel