feat(deployment): update semaphore configuration and deployment workflows

deployment/stacks/semaphore/docker-compose.yml

@@ -41,6 +41,22 @@ services:
       # Only bind to localhost, not external interfaces
       # Default port 3001 to avoid conflict with Gitea (port 3000)
       - "127.0.0.1:${SEMAPHORE_PORT:-3001}:3000"
+    labels:
+      # Traefik configuration
+      - "traefik.enable=true"
+      # HTTP Router (redirects to HTTPS)
+      - "traefik.http.routers.semaphore.rule=Host(`semaphore.michaelschiemer.de`)"
+      - "traefik.http.routers.semaphore.entrypoints=web"
+      - "traefik.http.routers.semaphore.middlewares=redirect-to-https"
+      # HTTPS Router
+      - "traefik.http.routers.semaphore-secure.rule=Host(`semaphore.michaelschiemer.de`)"
+      - "traefik.http.routers.semaphore-secure.entrypoints=websecure"
+      - "traefik.http.routers.semaphore-secure.tls=true"
+      - "traefik.http.routers.semaphore-secure.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.semaphore-secure.service=semaphore"
+      # Service definition (use container IP in host network mode)
+      - "traefik.http.services.semaphore.loadbalancer.server.scheme=http"
+      - "traefik.http.services.semaphore.loadbalancer.server.port=3000"
     environment:
       - TZ=Europe/Berlin
       # Database Configuration
@@ -68,7 +84,7 @@ services:
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     healthcheck:
-      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/api/health"]
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/"]
       interval: 30s
       timeout: 10s
       retries: 3