Fix Planner/Journal healthchecks; auto-clean compose orphans

The compose healthcheck for both apps was `curl -sf http://localhost:.../health`,
but node:25-slim (Debian trixie-slim) ships neither curl nor wget, so
the check always reported the containers as `unhealthy` even while they
were happily serving 200s. Install curl in both Dockerfiles.

Separately, today's flagship BRouter cleanup (PR #297) left an orphan
`brouter` container behind because cd-infra's `docker compose up -d <list>`
doesn't pass `--remove-orphans`. I had to remove it by hand. Pass the
flag in both cd-infra and cd-apps so future service deletions clean up
on the next deploy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/cd-apps.yml

@@ -105,7 +105,9 @@ jobs:
             # Pull and deploy app containers
             docker compose --env-file app.env pull journal planner
             docker compose --env-file app.env run --rm journal npx drizzle-kit push --config /app/packages/db/drizzle.config.ts --force
-            docker compose --env-file app.env up -d journal planner
+            # --remove-orphans cleans up containers whose service was deleted
+            # from the compose file, matching cd-infra's behaviour.
+            docker compose --env-file app.env up -d --remove-orphans journal planner
 
             # Clean up
             docker image prune -af

.github/workflows/cd-infra.yml

@@ -79,8 +79,11 @@ jobs:
             if [ "${{ github.event.inputs.restart_all }}" = "true" ]; then
               docker compose --env-file .env up -d --remove-orphans
             else
-              # Restart infra services (except Caddy — just reload its config)
-              docker compose --env-file .env up -d postgres prometheus loki promtail grafana postgres-exporter node-exporter cadvisor
+              # Restart infra services (except Caddy — just reload its config).
+              # --remove-orphans cleans up containers whose service was deleted
+              # from the compose file (e.g., the flagship `brouter` removal in
+              # PR #297 left an orphan that had to be removed by hand).
+              docker compose --env-file .env up -d --remove-orphans postgres prometheus loki promtail grafana postgres-exporter node-exporter cadvisor
               docker compose exec caddy caddy reload --config /etc/caddy/Caddyfile
             fi
 

apps/journal/Dockerfile

@@ -1,5 +1,7 @@
 FROM node:25-slim AS base
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+# curl is used by the docker-compose healthcheck (node:25-slim is Debian
+# trixie-slim and ships neither curl nor wget by default).
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
 RUN npm install -g pnpm@10.6.5
 WORKDIR /app
 

apps/planner/Dockerfile

@@ -1,5 +1,7 @@
 FROM node:25-slim AS base
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+# curl is used by the docker-compose healthcheck (node:25-slim is Debian
+# trixie-slim and ships neither curl nor wget by default).
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
 RUN npm install -g pnpm@10.6.5
 WORKDIR /app