Fix 502 after update: safe startup, single DB init, healthcheck

Co-authored-by: Cursor <cursoragent@cursor.com>

entrypoint.sh

@@ -1,14 +1,18 @@
 #!/bin/sh
 set -e
 
-# Mounted /repo belongs to host user; appuser needs write access for git deploy.
+# Git deploy needs write access to mounted /repo; never fail container start on chown errors.
 if [ "$ALLOW_GIT_DEPLOY" = "true" ] || [ "$ALLOW_GIT_DEPLOY" = "1" ] || [ "$ALLOW_GIT_DEPLOY" = "yes" ]; then
     if [ -d /repo/.git ]; then
-        chown -R appuser:appuser /repo
-        chmod -R u+rwX /repo/.git
+        chown -R appuser:appuser /repo 2>/dev/null || true
+        chmod -R u+rwX /repo/.git 2>/dev/null || true
     elif [ -d /repo ]; then
-        chown -R appuser:appuser /repo
+        chown -R appuser:appuser /repo 2>/dev/null || true
     fi
 fi
 
+# Run DB migrations once before gunicorn workers start.
+gosu appuser python /app/init_db.py
+
+export SKIP_DB_INIT=1
 exec gosu appuser "$@"