Dockerfile takes SOURCE_COMMIT as a build arg and bakes it into the
image as GIT_COMMIT. Coolify sets SOURCE_COMMIT on every deploy, so
the value in the footer changes with each successful push → build.
ARG is placed after COPY . so only a thin final layer rebuilds when
the SHA changes; pip install stays cached. Outside Coolify the
default is "dev" and the footer renders "build dev".
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three isolated services (alert scraper, apply HTTP worker, web UI+DB)
with argon2 auth, signed cookies, CSRF, rate-limited login, kill switch,
apply circuit breaker, audit log, and strict CSP.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
