feat(server): deploy the API to Serverpod Cloud (re-land #115 on main)

[TOMOKI977]

Refs #31

Summary

This PR re-lands #115 on main. #115 was merged into chore/110-serverpod-4-upgrade after #114 had already merged, because its base was never retargeted. Its code (Serverpod Cloud deploy, CORS gate, health version) therefore never reached main.

The branch is the same one: origin/main is merged in, and the conflicts are resolved by keeping the branch side, whose tree equals fc8b9e6. The squash of #114 left identical content on both sides, so nothing new is introduced. The diff against main is exactly the 17 files of #115 (+1011/-4).

The content is unchanged from #115, which @moises-cisneros already tested: analysis is clean, the unit tests pass, and the live API returns the health version and the 200/403 CORS responses.

What lands:

• Health version: /health/check reports 1.0.0+<sha>. PULS3_GIT_SHA is set by the scloud pre-deploy script (tool/set_deploy_sha.dart).
• CORS gate: PULS3_ALLOWED_ORIGINS sets the allowed origins, and loopback origins are allowed only in development.
• Serverpod Cloud config: scloud.yaml is linked to puls3-hub-on-stellar, and .scloudignore excludes .env, passwords.yaml and the tests.
• Docs: the "Deploy to Serverpod Cloud" section in puls3_server/README.md.
• Pages: scripts/cloudflare-pages-build.sh passes PULS3_API_URL as a dart-define.
• .env.example: PULS3_ALLOWED_ORIGINS and PULS3_GIT_SHA.

Acceptance criteria

Unchanged from #115:

• The public app works end to end on testnet (GIF). Pending the Pages deploy and the demo flow.
• health returns the deployed version.
• A teammate redeploys by following the README.
• No secret in the repo or the upload.
• Both URLs are in the README.

Verification evidence

$ git diff --cached fc8b9e6        # after resolving the merge: empty
$ git diff --stat origin/main..HEAD
 17 files changed, 1011 insertions(+), 4 deletions(-)
$ cd puls3_server && dart analyze --fatal-infos
No issues found!
$ dart test test/unit
00:12 +325: All tests passed!
$ bash scripts/tests/env-inventory.test.sh
passed: 68, failed: 0
$ bash scripts/tests/cloudflare-pages-build.test.sh
passed 7, failed 0

Notes for reviewers

• After this merges, the Serverpod Cloud database will be wiped and the server redeployed from main. The live DB carries the pre-rebase upgrade-4-0 migration name. It holds no real data, and the team agreed to the wipe.
• The non-blocking notes from build(serverpod)!: upgrade to Serverpod 4.0.4 for Cloud deployment #114 and feat(server): deploy the API to Serverpod Cloud with health version and CORS gate #115 are tracked for a follow-up and are not part of this re-land:
  • the shell-form ENTRYPOINT
  • alpine:latest
  • a migration regression test
  • untracked files not marked -dirty
  • PULS3_GIT_SHA set before the upload
  • the OPTIONS header
• delete_branch_on_merge is now enabled on the repo. When a parent PR merges, GitHub deletes its branch and retargets stacked PRs to main, which prevents this from happening again.

[cloudflare-workers-and-pages]

Deploying puls3 with    Cloudflare Pages

Latest commit:	80ea9d0
Status:	✅  Deploy successful!
Preview URL:	https://299339e0.puls3-4lw.pages.dev
Branch Preview URL:	https://chore-110-serverpod-4-upgrad.puls3-4lw.pages.dev

View logs

[TOMOKI977]

@moises-cisneros @fercodes @Pericena @XxHugheadxX this needs a quick review and approval, with priority: it is P0 and blocks the Serverpod Cloud redeploy (#31).

It is the same content as #115. Moises already tested it there, but it was merged into the parent branch instead of main, so the Cloud deploy code never landed. The diff against main is exactly the 17 files of #115, and all checks are green.

Moises, your non-blocking notes from #114 and #115 will go into a follow-up, so they don't hold this up.

Once it merges I'll wipe the Cloud DB and redeploy from main.

[XxHugheadxX]

Reviewed and verified locally. Approving.

Re-land is exact

• git diff fc8b9e6 pr117 is empty, so the tree equals #115.
• The merge base is the current tip of main, and the diff against main is the 17 files of #115 (+1011/-4).
• scripts/tests/cloudflare-pages-build.test.sh: 7 passed, 0 failed. scripts/tests/env-inventory.test.sh: 68 passed, 0 failed.

CORS gate checked against Serverpod 4.0.4 source

• In 4.0.4, Server.injectIn still registers the core _headers middleware around user middleware, and _headers answers OPTIONS before originGate runs. The documented preflight behavior still holds.
• The native SERVERPOD_ALLOWED_ORIGINS in 4.0.4 only guards the WebSocket handshake and credentialed CORS when authCookie is set. We don't use authCookie, so the custom gate is still the only thing rejecting cross-origin POSTs.

Non-blocking, for the follow-up list

1. puls3_server/README.md ("Health version and allowed origins") and the originGate docstring still say "Serverpod 3.4.13". The behavior is the same in 4.0.4; only the version number in the text is stale.
2. The Deploy table in the root README.md still shows https://<project-id>.api.serverpod.space/ ("set after the first deploy"). The real URL, https://puls3-hub-on-stellar.api.serverpod.space/, is already in the server README. Needed for the "Both URLs are in the README" criterion of #31.
3. Minor: the gate's 403 response gets Access-Control-Allow-Origin: *, because core _headers fills absent headers with ??=. Harmless, since the endpoint never runs.

I couldn't run dart analyze / dart test locally, so I'm relying on the CI checks being green before merge. After merge: wipe the DB, redeploy from main, and run the three curl checks from step 7 (200 / 403 / 403).