Fix CI boot check: don't publish a fixed host port

This runner's snap-Docker install has a known AppArmor bug denying
docker stop/kill -- a leftover container from any failed run would
permanently squat host port 8137, so every SUBSEQUENT run's docker
run also failed immediately (port already allocated), compounding
into a cascading failure loop. Uses a unique-per-run container name
and curls the container's own bridge-network IP directly instead of
publishing any host port at all.

.forgejo/workflows/build.yml

@@ -28,16 +28,24 @@ jobs:
         run: docker build -t thermograph-backend:ci .
 
       - name: Boot + health check
+        # No -p host-port publish and a unique-per-run container name (this
+        # runner's snap-Docker install has a known AppArmor bug denying
+        # docker stop/kill -- a leftover container from a prior failed run
+        # would otherwise permanently squat a fixed host port and block
+        # every subsequent run too). Curl the container's own bridge-network
+        # IP directly instead.
         run: |
-          docker run -d --name backend-ci \
+          name="backend-ci-$$"
+          docker run -d --name "$name" \
             -e THERMOGRAPH_FRONTEND_BASE_INTERNAL=http://127.0.0.1:1 \
-            -p 8137:8137 thermograph-backend:ci
+            thermograph-backend:ci
+          ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$name")
           ok=0
           for i in $(seq 1 30); do
-            if curl -fsS -o /dev/null http://127.0.0.1:8137/healthz; then ok=1; break; fi
+            if curl -fsS -o /dev/null "http://${ip}:8137/healthz"; then ok=1; break; fi
             sleep 1
           done
-          docker logs backend-ci
-          docker rm -f backend-ci >/dev/null 2>&1 || true
+          docker logs "$name"
+          docker rm -f "$name" >/dev/null 2>&1 || true
           if [ "$ok" != 1 ]; then echo "backend never became healthy"; exit 1; fi
           echo "OK: backend booted standalone"