fix(ci): add provenance: false to fix registry push failures

OCI attestation manifests fail to push on Gitea registry when image
layers already exist (cross-repo blob references). Disabling provenance
generation on all four build-push-action steps ensures a simple single
manifest push that Gitea handles reliably.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.gitea/workflows/ci.yml

@@ -91,11 +91,11 @@ jobs:
       - name: Build and push API image
         uses: docker/build-push-action@v6
         with:
+          provenance: false
           context: .
           file: Dockerfile
           target: runner
           push: true
-          provenance: false
           tags: |
             git.farh.net/groombook/api:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/api:latest' || '' }}
@@ -105,11 +105,11 @@ jobs:
       - name: Build and push Migrate image
         uses: docker/build-push-action@v6
         with:
+          provenance: false
           context: .
           file: Dockerfile
           target: migrate
           push: true
-          provenance: false
           tags: |
             git.farh.net/groombook/migrate:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/migrate:latest' || '' }}
@@ -119,11 +119,11 @@ jobs:
       - name: Build and push Seed image
         uses: docker/build-push-action@v6
         with:
+          provenance: false
           context: .
           file: Dockerfile
           target: seed
           push: true
-          provenance: false
           tags: |
             git.farh.net/groombook/seed:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/seed:latest' || '' }}
@@ -133,11 +133,11 @@ jobs:
       - name: Build and push Reset image
         uses: docker/build-push-action@v6
         with:
+          provenance: false
           context: .
           file: Dockerfile
           target: reset
           push: true
-          provenance: false
           tags: |
             git.farh.net/groombook/reset:${{ steps.version.outputs.tag }}
             ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/reset:latest' || '' }}

src/index.ts

@@ -59,9 +59,6 @@ app.use(
 );
 
 // Health check — no auth required, registered on app at full path before auth middleware
-// /health: used by Dockerfile HEALTHCHECK and K8s readinessProbe/livenessProbe (port 3000 direct)
-app.get("/health", (c) => c.json({ status: "ok" }));
-// /api/health: used by Gateway HTTPRoute (/api/* → API pod)
 app.get("/api/health", (c) => c.json({ status: "ok" }));
 
 // Public booking routes — no auth required, must be registered before auth middleware