feat: auto-healing system — HEALTHCHECK, rate-limiter cleanup, auto-rollback CI, watchdog

- Dockerfile: add HEALTHCHECK (30s interval, 10s timeout, 3 retries)
- rate-limit.ts: auto-cleanup stale entries every 5 min (prevents memory leak)
- scripts/auto-heal.sh: watchdog for Synology cron — auto-restarts container,
  reloads nginx gateway, escalates on excessive failures
- CI workflow: auto-rollback on deploy failure (tags :rollback image,
  reverts if health check fails after deploy)

src/lib/rate-limit.ts

@@ -3,8 +3,29 @@ const rateMap = new Map<string, { count: number; resetAt: number }>();
 const WINDOW_MS = 15 * 60 * 1000;
 const MAX_ATTEMPTS = 10;
 
+// Auto-cleanup stale entries every 5 minutes to prevent memory leaks
+const CLEANUP_INTERVAL = 5 * 60 * 1000;
+let lastCleanup = Date.now();
+
+function cleanupStaleEntries(): void {
+  const now = Date.now();
+  if (now - lastCleanup < CLEANUP_INTERVAL) return;
+  lastCleanup = now;
+  let removed = 0;
+  for (const [ip, entry] of rateMap.entries()) {
+    if (now > entry.resetAt) {
+      rateMap.delete(ip);
+      removed++;
+    }
+  }
+  if (removed > 0) {
+    console.debug(`[rate-limiter] Cleaned up ${removed} stale entries, map size: ${rateMap.size}`);
+  }
+}
+
 export function checkRateLimit(ip: string): { allowed: boolean; remaining: number } {
   const now = Date.now();
+  cleanupStaleEntries();
   const entry = rateMap.get(ip);
 
   if (!entry || now > entry.resetAt) {