fix(phasefinal-web): healthcheck targeted ::1, so traefik skipped the container

The healthcheck used http://localhost/, which resolves to ::1 in nginx:alpine
while nginx listens on IPv4 only — so it never passed, the container stayed
unhealthy, and Traefik silently declined to create a router for it. That
presents as a broken docker provider: correct labels, right network, no route,
no error. Target 127.0.0.1 explicitly and add a start_period.

Adds the apex router (301 phasefinal.com -> www) and drops the file-provider
workaround, which was mitigating the wrong diagnosis.

stacks/phasefinal-web/compose.yaml

@@ -9,16 +9,30 @@ services:
     networks:
       - tnet
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost/"]
+      # 127.0.0.1, NOT localhost: in this image `localhost` resolves to ::1 and
+      # nginx listens on IPv4 only, so `localhost` gives "Connection refused"
+      # forever. Traefik SKIPS unhealthy containers, so a wrong healthcheck here
+      # silently means "no route" rather than "unhealthy service".
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:80/"]
       interval: 30s
       timeout: 5s
       retries: 3
+      start_period: 10s
     labels:
       - traefik.enable=true
       - traefik.http.routers.phasefinal-web.rule=Host(`www.phasefinal.com`)
       - traefik.http.routers.phasefinal-web.tls=true
       - traefik.http.routers.phasefinal-web.tls.certresolver=anaprod
       - traefik.http.services.phasefinal-web.loadbalancer.server.port=80
+      # apex -> www, 301
+      - traefik.http.routers.phasefinal-apex.rule=Host(`phasefinal.com`)
+      - traefik.http.routers.phasefinal-apex.tls=true
+      - traefik.http.routers.phasefinal-apex.tls.certresolver=anaprod
+      - traefik.http.routers.phasefinal-apex.service=phasefinal-web
+      - traefik.http.routers.phasefinal-apex.middlewares=phasefinal-to-www
+      - traefik.http.middlewares.phasefinal-to-www.redirectregex.regex=^https?://phasefinal\.com/(.*)
+      - traefik.http.middlewares.phasefinal-to-www.redirectregex.replacement=https://www.phasefinal.com/$${1}
+      - traefik.http.middlewares.phasefinal-to-www.redirectregex.permanent=true
 
 networks:
   tnet: