Supervise the engine's host: deep health, loop watchdog, one worker

The API image ran four uvicorn workers, and each one built a full flow
controller — four sets of MQTT subscriptions, cron ticks and webhooks.
Runs one worker now; scaling out is the worker split, not more processes.

Adds a loop-lag watchdog and a deep /utils/health/ that fails when the
event loop is wedged or Redis is unreachable, the two failure modes a
process-alive check never sees. Autoheal restarts on that signal, behind
a compose profile because it mounts the Docker socket.

The private user-seeding routes now need an explicit opt-in rather than
just ENVIRONMENT=local, so a deployment that kept the default never
exposes them.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011LF61rxW1FG5YCD2J9YqjY

Makefile

@@ -14,6 +14,9 @@ COMPOSE_PROJECT := fluksio-app
 # Compose interpolation needs the project-local .env before reading compose.yml.
 COMPOSE := docker compose -p $(COMPOSE_PROJECT) --env-file $(COMPOSE_ROOT)/.env
 COMPOSE_PROD := $(COMPOSE) -f docker/compose.yml
+# Production also runs autoheal, which restarts the backend when its deep
+# health check fails. It is profile-gated because it mounts the Docker socket.
+COMPOSE_PROD_RUN := $(COMPOSE_PROD) --profile autoheal
 COMPOSE_DEV := $(COMPOSE_PROD) -f docker/compose.dev.yml
 # Integrated local stack: dev stack wired onto the shared `proxy` network.
 COMPOSE_LOCAL := $(COMPOSE_DEV) -f docker/compose.local.yml
@@ -34,17 +37,17 @@ dev-local:  ## Start the integrated local stack (called by the root `make dev`)
 	  $(COMPOSE_LOCAL) up --build -d proxy db adminer prestart backend frontend mailcatcher
 
 up:  ## Start the production stack
-	$(COMPOSE_PROD) up --build -d
+	$(COMPOSE_PROD_RUN) up --build -d
 
 update:  ## Pull, rebuild using the layer cache, and recreate changed containers
 	git pull
-	$(COMPOSE_PROD) build
-	$(COMPOSE_PROD) up -d --remove-orphans
+	$(COMPOSE_PROD_RUN) build
+	$(COMPOSE_PROD_RUN) up -d --remove-orphans
 	docker image prune -f
 
 down:  ## Stop all running containers
 	-$(COMPOSE_LOCAL) down
-	-$(COMPOSE_PROD) down
+	-$(COMPOSE_PROD_RUN) down
 
 # ── Development (local, no Docker) ───────────────────────────────
 # Run `make dev-backend` and `make dev-frontend` in two separate terminals.