ci(f6.1): require real Nest startup and health check

.github/workflows/ci.yml

@@ -69,7 +69,7 @@ jobs:
           grep -Fq -- '$STAGE/android-app:/android-app:ro' scripts/deploy-github.sh
       - name: Validate Compose
         run: docker compose --env-file .env.example config >/dev/null
-      - name: Rehearse migrations on clean PostGIS
+      - name: Rehearse migrations and real API startup on clean PostGIS
         run: |
           set -Eeuo pipefail
           cleanup() {
@@ -216,7 +216,35 @@ jobs:
             exit 1
           }
           rm -f "$rerun_log"
-      - name: VPS-equivalent isolated API preflight
+
+          # A build-only preflight cannot catch Nest dependency-injection or
+          # runtime configuration failures. Start the production API image against
+          # the migrated database and require the public health endpoint to answer.
+          export JWT_ACCESS_SECRET='CI_ACCESS_SECRET_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
+          export REFRESH_TOKEN_PEPPER='CI_REFRESH_PEPPER_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
+          export SMTP_SETTINGS_MASTER_KEY=''
+          docker compose --env-file .env.example build api
+          docker compose --env-file .env.example up -d api
+
+          api_ready=0
+          for _ in $(seq 1 30); do
+            if curl -fsS http://127.0.0.1:3101/api/v3/health >/tmp/dhv2-health.json 2>/dev/null; then
+              api_ready=1
+              break
+            fi
+            sleep 2
+          done
+          if [ "$api_ready" -ne 1 ]; then
+            echo 'ERROR: production API image did not become healthy.' >&2
+            docker compose --env-file .env.example logs --no-color api >&2 || true
+            exit 1
+          fi
+          grep -Fq '"status":"ok"' /tmp/dhv2-health.json || {
+            echo 'ERROR: /api/v3/health did not report status ok.' >&2
+            cat /tmp/dhv2-health.json >&2
+            exit 1
+          }
+      - name: Isolated builder test preflight
         run: |
           set -Eeuo pipefail
           image="dhv2-api:ci-vps-preflight-${GITHUB_SHA::12}"