Fix BRouter first-deploy issues discovered during cutover

Three fixes after the first cd-brouter run on the dedicated host:

1. **BRouter 1.7.8 → 1.7.9** (`docker/brouter/Dockerfile`). Planet RD5
   segments on brouter.de are now version 11; 1.7.8's `lookups.dat`
   is v10, causing `lookup version mismatch (old rd5?)
   lookups.dat=10 E10_N45.rd5=11` on every route request.

2. **cd-brouter.yml: docker login to ghcr.io before pull**.
   ghcr.io/trails-cool/brouter is private, and the dedicated host's
   Docker daemon isn't logged in by default. Extract DEPLOY_GHCR_TOKEN
   from SOPS at runner side, pass to the SSH step via envs, and
   `docker login` before `docker compose pull`. Credential is
   `::add-mask::`-ed so it doesn't show in logs.

3. **Drop custom healthcheck** on the brouter service. The image
   strips wget/curl post-build, and /bin/sh in the base doesn't
   support /dev/tcp, so there's no in-image way to do an HTTP probe.
   Real health is observed via Caddy's upstream 502 behavior on
   outage and the Planner-side `brouter_request_duration_seconds`
   metric. caddy's `depends_on` drops from service_healthy to
   service_started.

End-to-end verified on the dedicated host after applying the compose
fix manually:
- Caddy enforces auth: 403 without header, proxies with.
- BRouter 1.7.9 will resolve the segment-version error once the image
  is rebuilt.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/cd-brouter.yml

@@ -45,6 +45,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Decrypt shared secret
+        id: decrypt
         run: |
           curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64
           chmod +x sops-v3.9.4.linux.amd64
@@ -55,6 +56,14 @@ jobs:
             | grep '^BROUTER_AUTH_TOKEN=' > infrastructure/brouter-host/.env
           chmod 0600 infrastructure/brouter-host/.env
 
+          # GHCR pull credential — not shipped to the host's filesystem;
+          # passed to the SSH step as an env var so it only lives in
+          # memory during `docker login`.
+          GHCR_TOKEN=$(SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env \
+            | grep '^DEPLOY_GHCR_TOKEN=' | cut -d= -f2-)
+          echo "::add-mask::$GHCR_TOKEN"
+          echo "GHCR_TOKEN=$GHCR_TOKEN" >> $GITHUB_ENV
+
       - name: Copy compose project to dedicated host
         uses: appleboy/scp-action@v1
         with:
@@ -73,6 +82,7 @@ jobs:
           username: trails
           port: ${{ secrets.BROUTER_DEPLOY_SSH_PORT }}
           key: ${{ secrets.BROUTER_DEPLOY_SSH_KEY }}
+          envs: GHCR_TOKEN
           script: |
             set -euo pipefail
             cd /home/trails/brouter
@@ -89,6 +99,11 @@ jobs:
               mkdir -p segments
             fi
 
+            # GHCR images (brouter) are private; log in so pull works.
+            # Credentials stay in ~/.docker/config.json; acceptable on a
+            # single-tenant trails user.
+            echo "$GHCR_TOKEN" | docker login ghcr.io -u stigi --password-stdin
+
             docker compose pull
             docker compose up -d --remove-orphans
             docker compose ps