feat: DNS & domain routing auto-healer — Cloudflare tunnels, DNS, gateway, routing integrity, SSL, Traefik

- dns-router-healer/Dockerfile: Alpine + curl, docker-cli, bash, jq, drill
- dns-router-healer/dns-router-heal.sh: 8 health checks in 60s cycle
  1. Cloudflare tunnels (primary + fallback) — restart on failure
  2. DNS resolution — verify all falah domains → Cloudflare IPs
  3. Direct service health — local health endpoint
  4. Gateway routing — nginx on port 7878
  5. Routing integrity — gateway response matches direct
  6. Public endpoint via Cloudflare (every 5 cycles)
  7. SSL certificate expiry (every 10 cycles)
  8. Traefik detection (every 5 cycles) — standalone or Swarm
- docker-compose.dns-healer.yml: sidecar deployment config
- .pi/agents/dns-healer.md: pi agent definition

.pi/agents/dns-healer.md

@@ -0,0 +1,52 @@
+---
+name: dns-healer
+description: DNS & domain routing auto-healer — Cloudflare tunnels, Traefik, nginx gateway, SSL certs, DNS resolution
+tools: read, bash
+---
+
+# DNS & Domain Routing Auto-Healer
+
+Monitors and auto-fixes the full routing chain:
+
+```
+User → Cloudflare DNS → Cloudflare Tunnel → Gateway nginx → Microservice
+```
+
+## What It Checks (every 60s)
+
+| Check | What | Auto-Fix |
+|---|---|---|
+| Cloudflare Tunnel | Container status | Restart tunnel container |
+| DNS Resolution | Domains resolve to Cloudflare IPs | Alert only (needs API token) |
+| Direct Service | Local health endpoint | Already handled by app auto-healer |
+| Gateway Routing | nginx proxies correctly | Reload nginx, restart container |
+| Routing Integrity | Gateway response matches direct | Alert on mismatch |
+| Public Endpoint | URL accessible via Cloudflare | Alert on origin errors |
+| SSL Certs | Certificate expiration | Alert if <7 days |
+| Traefik | If deployed (standalone or Swarm) | Restart container |
+
+## Common Fixes
+
+```bash
+# Restart tunnel
+docker restart cloudflare-YT01
+
+# Reload nginx gateway
+docker exec falah-umbrel-api-gateway nginx -s reload
+
+# Restart gateway
+docker restart falah-umbrel-api-gateway
+
+# Verify tunnel config from Cloudflare dashboard
+# Tunnel token: eyJhIjoiZjM1ZGI5M2YwMTkwZjIwMzA3NzM4OTEzNjE2OWNjMGI...
+
+# Check tunnel ingress rules
+# Cloudflare Dashboard → Zero Trust → Tunnels → YT01
+```
+
+## Escalation
+
+If tunnel fails to restart 3 times in an hour, or public endpoint returns 521/522 for 5+ minutes:
+1. Log full diagnostics
+2. Do NOT keep restarting (rate limit: 3 restarts/hour)
+3. Check Cloudflare dashboard for origin status