feat: DNS & domain routing auto-healer — Cloudflare tunnels, DNS, gateway, routing integrity, SSL, Traefik

- dns-router-healer/Dockerfile: Alpine + curl, docker-cli, bash, jq, drill
- dns-router-healer/dns-router-heal.sh: 8 health checks in 60s cycle
  1. Cloudflare tunnels (primary + fallback) — restart on failure
  2. DNS resolution — verify all falah domains → Cloudflare IPs
  3. Direct service health — local health endpoint
  4. Gateway routing — nginx on port 7878
  5. Routing integrity — gateway response matches direct
  6. Public endpoint via Cloudflare (every 5 cycles)
  7. SSL certificate expiry (every 10 cycles)
  8. Traefik detection (every 5 cycles) — standalone or Swarm
- docker-compose.dns-healer.yml: sidecar deployment config
- .pi/agents/dns-healer.md: pi agent definition

dns-router-healer/docker-compose.dns-healer.yml

@@ -0,0 +1,29 @@
+version: "3.8"
+services:
+  falah-dns-healer:
+    build:
+      context: ./dns-router-healer
+      dockerfile: Dockerfile
+    image: falah-dns-healer:latest
+    container_name: falah-dns-healer
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /var/log/falah:/var/log/falah
+      - /var/state/falah:/var/state/falah
+    environment:
+      - DOMAINS=falahos.my api.falahos.my git.falahos.my app.falahos.my
+      - DIRECT_HEALTH=http://localhost:4014/mobile/api/health
+      - GATEWAY_URL=http://localhost:7878/mobile/api/health
+      - TUNNEL_URL=https://falahos.my/mobile/api/health
+      - TUNNEL_PRIMARY=cloudflare-YT01
+      - TUNNEL_FALLBACK=falah-tunnel
+      - GATEWAY_CONTAINER=falah-umbrel-api-gateway
+      - TRAEFIK_CONTAINER=falah_traefik
+      - CHECK_INTERVAL=60
+    network_mode: "host"
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"