hotfix: pin docker-compose to GHCR :1.3.3 — rule out runtime, prove infra (#151)

Production at healthlog.bombeck.io has been 503-ing through every
attempted recovery today: Coolify restart, force-rebuild, pin to
:1.4.0, full source-tree rollback to the v1.4.0 commit. Each deploy
finishes clean, the container boots ("Ready in 0ms", pg-boss workers
running), but no HTTP request ever lands inside the app. Other apps
on the same Coolify host also stopped responding to direct-origin
probes (workbalance, birthdaylog, helpdesk, 4goats — all curl 000),
which makes a server-side Traefik / docker-network regression the
most likely culprit, not anything we shipped.

This commit pins to GHCR `:1.3.3` (yesterday's release, verifiably
healthy across self-host installs) and removes the `build:` block so
Coolify pulls the prebuilt multi-arch image instead of attempting
another local rebuild. If this image boots and Traefik routes to
it, the regression is in v1.4.x source. If it 503s identically, the
infra fault on apps-01 is conclusive.

The v1.4.0 / v1.4.1 work is preserved — both the v1.4.0 GHCR image
and the v1.4.1 GHCR image (built earlier today) remain available
for re-pinning once the deployment path is healthy again.

docker-compose.yml

@@ -4,10 +4,12 @@ services:
   # For horizontal scaling switch to the web/worker split below
   # (HEALTHLOG_PROCESS_TYPE=web on this service + uncomment app-worker).
   app:
-    image: ghcr.io/mbombeck/healthlog:latest
-    build:
-      context: .
-      dockerfile: Dockerfile
+    # Pinned to GHCR :1.3.3 multi-arch image (gestern released, audit-tested).
+    # Production on apps-01 has been 503-ing since today's deploys; rolling back
+    # to the last release that's verifiably running on self-host installs to
+    # rule out runtime / Docker-network issues. No `build:` block on purpose:
+    # we want Coolify to PULL the prebuilt image, not build from source.
+    image: ghcr.io/mbombeck/healthlog:1.3.3
     container_name: healthlog-app
     ports:
       - "3000:3000"