ci: add tunnel-reachability diagnostic step

Three curls after wait-for-health: HEAD on /api/health (verify
x-envoy-upstream-service-time + x-cache-status), GET on
/api/dictionary/1/world_regions (verify real upstream returns
real JSON), then a second HEAD on the same URL (verify cache HIT).
Surfaces routing + cache state up-front so any future failure is
attributable.

.gitea/workflows/ci-deploy.yml

@@ -94,6 +94,22 @@ jobs:
           BASIC_AUTH_PASS: ${{ secrets.BASIC_AUTH_PASS }}
         run: scripts/ci/wait-for-url.sh https://ui-dashboard.gnerim.ru/ 30 2
 
+      - name: Diagnose tunnel reachability
+        id: tunnel_check
+        env:
+          BASIC_AUTH_USER: ${{ secrets.BASIC_AUTH_USER }}
+          BASIC_AUTH_PASS: ${{ secrets.BASIC_AUTH_PASS }}
+        run: |
+          echo "--- /api/health (expect 200 + x-envoy-upstream-service-time + x-cache-status) ---"
+          curl -k -sSI -u "$BASIC_AUTH_USER:$BASIC_AUTH_PASS" https://ui-dashboard.gnerim.ru/api/health | head -15
+          echo "--- /api/dictionary/1/world_regions (expect JSON, ~5KB) ---"
+          curl -k -sS -u "$BASIC_AUTH_USER:$BASIC_AUTH_PASS" \
+            -w "\n[size=%{size_download} time=%{time_total}s code=%{http_code}]\n" \
+            https://ui-dashboard.gnerim.ru/api/dictionary/1/world_regions | head -c 400; echo
+          echo "--- second hit on the same dict (expect HIT) ---"
+          curl -k -sSI -u "$BASIC_AUTH_USER:$BASIC_AUTH_PASS" \
+            https://ui-dashboard.gnerim.ru/api/dictionary/1/world_regions | grep -iE "^HTTP|x-cache|x-envoy"
+
       - name: Install Playwright browsers
         id: playwright_install
         run: pnpm exec playwright install --with-deps chromium