fix(deploy): second-round hardening — drain budget, CI smoke, SSL_REQUIRED trim

[vrogojin]

Summary

Second pass of the steelman review on the hardening landed via #298. All findings from that review that could be addressed with code are addressed here. Branch protection on `main` is the only outstanding item and needs a GitHub Settings UI click, not code.

entrypoint.sh

• nginx drain budget 2s → 10s. The previous poll loop (`10 × sleep 0.2`) gave in-flight requests only 2 seconds to finish before tini SIGKILLed nginx. Matches nginx's own graceful-stop SLA now.
• Log timeout. If the 10s budget is exceeded, an explicit `WARNING: nginx did not drain within 10s; forcing exit` hits stderr so operators see truncated requests with a reason rather than silence.
• Integer sleep. Using `sleep 1` instead of `sleep 0.2` so the loop is portable to BusyBox-coreutils bases (`sleep 0.2` becomes `sleep 0` there, producing a spin loop).
• SSL_REQUIRED whitespace trim. Values like `" true "` (common when pasted from `.env` files) are now accepted after ltrim/rtrim instead of hard-failing the container.

docker-validate.yml

• `workflow_dispatch` trigger added so transient CI failures can be re-run without pushing an empty commit.
• Smoke tests added for both matrix rows:
  • `Dockerfile`: `nginx -t` verifies the default config parses.
  • `Dockerfile.ssl`: confirms `tini`, `sphere-entrypoint`, `curl`, and `nginx` are present and that the entrypoint script is syntactically valid bash. Catches entrypoint-path typos and shebang regressions that previously only surfaced on deploy.
• Switched `load: false` → `load: true` so the smoke steps can actually run the built image.

Test plan (ran locally)

• `bash -n deploy/entrypoint.sh` clean.
• `docker build -f Dockerfile.ssl` succeeds.
• `SSL_REQUIRED=" true "` now boots (was: exit 1).
• `SSL_REQUIRED="bogus"` still exits 1 with the clear error.
• `docker stop --time=15` produces exit code 143 (signal-clean shutdown path).
• Smoke command used in CI runs green against the locally-built image.
• CI on this PR: `validate (Dockerfile)` and `validate (Dockerfile.ssl)` both green — gate for merge.

Outstanding (non-code)

• Enable branch protection on `main` and list `validate (Dockerfile)` + `validate (Dockerfile.ssl)` as required status checks. Requires GitHub Settings → Branches UI.