…ve sockets

Cloudflare edge half-closes idle keep-alive sockets, leaving undici's pool
with stale connections that produce a persistent 502 storm until the process
restarts. Use a dedicated Agent with short keepAliveTimeout (4s) so bad
sockets are evicted quickly and the next request opens a fresh connection.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…keep-alive sockets"

This reverts commit 9c58ad6.

…leases

The Docker job previously built and pushed in a single step. If the
resulting image crashed on startup (e.g. ERR_MODULE_NOT_FOUND from a
missing prod dep that only existed transitively in dev install), CI
still happily published the image to ghcr.io and it auto-deployed.

Split the build into three steps: build → load locally → docker run an
import-only smoke test against the actual production image → cache-hit
push. The smoke test invokes the image's node entry to import index.js,
which statically pulls in every route module under production deps. Any
top-level eval failure now blocks the push instead of shipping it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Three silent catches in the push pipeline made today's APNS_KEY=12-char
secret outage take hours to diagnose. Each one swallowed an exception
without a single log line, leaving 78 server with "Relay 502" but the
K8s pod logs completely empty:

- push.ts relay route: importPKCS8() throw was caught and turned into a
  502 JSON response with no log
- bridge.ts dispatchEventPush: dynamic import failure (e.g. missing prod
  dep) silently disabled all push notifications
- push.ts dispatchPush: badge_count UPDATE failure was a bare catch

All three now log via the existing pino logger so the next failure
surfaces immediately in `kubectl logs` instead of silently dropping
notifications.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>