Serve the API on 3000 and 8000 at once, matching the frontend image

Dokploy routes the domain to port 3000, but the container only bound 8000, so
the proxy had nothing to talk to and the domain returned 502 with a perfectly
healthy process behind it.

The frontend image already solved this by answering on both 80 and 3000
(`listen 80; listen 3000;` in nginx.conf). Do the same here rather than swap one
guess for another: 3000 is what the platform routes to, and 8000 is what the
README, the vite dev proxy and docker-compose all target, so binding both means
the container works whichever one it is pointed at.

uvicorn's CLI takes a single --port, but Server.run() accepts pre-bound
sockets, so serve.py binds each port and hands the list to one uvicorn - no
extra worker or second process to supervise. PORT still pins a single port for
anyone who wants one; PORTS changes the pair.

A port that cannot be bound is logged and skipped rather than being fatal,
since losing one of the two should not take down a service the platform only
routes to on the other. It exits non-zero only when nothing is listening at
all, so a genuinely dead container is still reported as failed.

The healthcheck moves into the same file and passes if either port answers,
which keeps it from drifting out of sync with what is actually bound.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -44,6 +44,7 @@ COPY app ./app
 COPY cli ./cli
 COPY scripts ./scripts
 COPY data ./data
+COPY serve.py .
 
 # Pristine copies of everything the app also WRITES to, kept at a path that is
 # never mounted over.
@@ -68,31 +69,29 @@ RUN mkdir -p /app/.bundled \
 # file) name them properly; this is the floor, not the recommended setup.
 VOLUME ["/app/data", "/app/app/intelligence/artifacts"]
 
-# The port uvicorn binds. Overridable because Dokploy assigns the container
-# port per service - the frontend image answers on both 80 and 3000 for the
-# same reason. A single process cannot listen twice, so this is the knob:
-#   PORT=3000  in the service's environment, if you standardise on 3000.
-ENV PORT=8000
-EXPOSE 8000
-
-# Liveness only. /api/health always answers 200 - it reports Postgres and
-# Ollama in the body as "degraded" rather than failing - which is deliberate
-# here: a healthcheck that went red whenever Postgres blinked would have
-# Dokploy restart a perfectly healthy API in a loop.
+# Answers on BOTH ports, the same way the frontend image does (nginx.conf has
+# `listen 80; listen 3000;`). 3000 is what Dokploy routes a domain to; 8000 is
+# what this project's README, the vite dev proxy and docker-compose all use.
+# Serving both means the container works whichever one the platform is pointed
+# at, instead of returning 502 from a perfectly healthy process.
 #
-# The 10s timeout is not padding: the handler probes Ollama over HTTP with a
-# 3s timeout of its own, so an unreachable Ollama makes every check take ~3s.
+# serve.py binds both sockets and hands them to one uvicorn - see the note
+# there. To pin a single port, set PORT (PORT=8080 serves only 8080); to change
+# the pair, set PORTS.
+ENV PORTS=3000,8000
+EXPOSE 3000 8000
+
+# Liveness only, and passes if EITHER port answers. /api/health always returns
+# 200 - it reports Postgres and Ollama in the body as "degraded" rather than
+# failing - which is deliberate: a check that went red whenever Postgres blinked
+# would have Dokploy restart a perfectly healthy API in a loop.
+#
+# The 10s timeout is not padding: the handler probes Ollama over HTTP with a 3s
+# timeout of its own, so an unreachable Ollama makes every check take ~3s.
 # start-period covers first boot, where the venv is still cold.
 HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
-    CMD python -c "import os,urllib.request;urllib.request.urlopen('http://127.0.0.1:'+os.environ.get('PORT','8000')+'/api/health',timeout=8)" || exit 1
+    CMD ["python", "serve.py", "--healthcheck"]
 
-# `exec` matters: without it the shell stays PID 1 and Docker's SIGTERM never
-# reaches uvicorn, so every deploy waits out the 10s kill timeout instead of
-# shutting down cleanly. sh is only here to expand $PORT.
-#
-# --proxy-headers/--forwarded-allow-ips: this container is never reached
-# directly - nginx (and, in prod, Dokploy's Traefik) sit in front of it.
-# Without these, uvicorn ignores X-Forwarded-Proto and reports every request as
-# plain http, so any redirect or generated absolute URL would downgrade an
-# https request.
-CMD ["sh", "-c", "exec uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-8000} --proxy-headers --forwarded-allow-ips '*'"]
+# Exec form: python is PID 1, so Docker's SIGTERM reaches it directly and a
+# redeploy shuts down cleanly instead of waiting out the 10s kill timeout.
+CMD ["python", "serve.py"]