harden(docker): non-root, dedicated healthcheck, opcache split, graceful shutdown

Coolify-doc-driven production hardening of the deploy stack:
- run the whole stack as non-root www-data; nginx on 8080 (non-privileged),
  pid in /tmp, user directive dropped (Coolify routes to any port)
- docker/healthcheck.sh: hit real /health route via PHP (not just port probe)
- split OPcache config into docker/php/opcache.ini
- graceful shutdown: supervisord stopsignal/stopwaitsecs + worker stop_grace_period
- APCu intentionally not added (Symfony cache uses redis)
- DEPLOY.md: 8080 port, non-root, resource-limit guidance

Verified on linux/amd64: non-root uid=82, /health 200, migrations run,
worker process healthcheck OK.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -64,11 +64,9 @@ services:
       RUN_INIT: "1" # runs JWT keygen + migrations on start (only this service)
     volumes: *app-volumes
     networks: [coolify]
-    # Hit the real /health route through nginx+fpm — verifies the app actually
-    # boots and serves (not just that port 80 is open). Uses PHP (always present)
-    # so we don't depend on curl/wget being in the image; fails on non-2xx.
+    # Hit the real /health route (nginx on 8080, non-root) via docker/healthcheck.sh.
     healthcheck:
-      test: ["CMD", "php", "-r", "$h=@get_headers('http://127.0.0.1:80/health'); exit($h && strpos($h[0],'200')!==false ? 0 : 1);"]
+      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
       interval: 15s
       timeout: 5s
       retries: 5
@@ -85,6 +83,9 @@ services:
     volumes: *app-volumes
     networks: [coolify]
     depends_on: [app]
+    # Messenger consumers handle SIGTERM gracefully — give the in-flight message
+    # time to finish before the container is killed.
+    stop_grace_period: 30s
     # No port to probe — just confirm the consumer process is alive (busybox ps).
     healthcheck:
       test: ["CMD-SHELL", "ps -o args 2>/dev/null | grep -q '[m]essenger:consume async' || exit 1"]
@@ -104,6 +105,7 @@ services:
     volumes: *app-volumes
     networks: [coolify]
     depends_on: [app]
+    stop_grace_period: 30s
     healthcheck:
       test: ["CMD-SHELL", "ps -o args 2>/dev/null | grep -q '[m]essenger:consume scheduler_default' || exit 1"]
       interval: 30s