deploy-container: wait for SSR readiness before returning from swap

Run 549's wait-for-health logged two HTTP 502s before its third
attempt succeeded — nginx → docker forwarding hit the new container
during the ~4s window between \`docker run -d\` returning and
Node.js inside finishing its boot. The retry loop covered it but the
log was noisy and a slower boot could blow past the 30×2s budget.

Added a post-run readiness probe inside swap: poll
http://127.0.0.1:${PORT}/ on the host (docker container is published
to 127.0.0.1, runner uses host network mode) until it answers 2xx,
up to 30 attempts × 1s. Skipped under --dry-run so the tests/ci/
shell tests still pass without touching the network.

Net effect: wait-for-url against the public URL now succeeds first
attempt, and the run aborts cleanly if the SSR doesn't come up at
all instead of looking healthy because nginx happens to keep a
warmed connection.

scripts/ci/deploy-container.sh

@@ -57,6 +57,25 @@ case "$CMD" in
     run run -d --name flights-web --restart unless-stopped \
       -p "127.0.0.1:${PORT}:8080" \
       "${IMAGE}:current"
+    # 5. Wait for the SSR inside the container to start listening before
+    #    returning. Without this, the next nginx-side probe gets a few
+    #    502s while Node.js is still booting — works (wait-for-url.sh
+    #    retries) but adds noise to the deploy log.
+    if [ "$DRY_RUN" -eq 0 ]; then
+      attempt=1
+      while [ "$attempt" -le 30 ]; do
+        if curl -fsS -o /dev/null "http://127.0.0.1:${PORT}/"; then
+          echo "swap: SSR ready on :${PORT} after $attempt attempt(s)"
+          break
+        fi
+        if [ "$attempt" -eq 30 ]; then
+          echo "swap: SSR did not respond on :${PORT} after 30 attempts" >&2
+          exit 1
+        fi
+        sleep 1
+        attempt=$((attempt + 1))
+      done
+    fi
     ;;
   rollback)
     if [ "$DRY_RUN" -eq 0 ] && ! docker image inspect "${IMAGE}:previous" >/dev/null 2>&1; then