chore: move prod container port from 8000 to 8080

- Dockerfile: EXPOSE + HEALTHCHECK + uvicorn --port all shift to 8080.
- docker-compose.yml: host:container mapping shifts to 8080:8080.
- run_dev.sh: new host-dev launcher; default PORT=8080 to stay in
  sync with the prod shape.

Caddy upstream config on the VM needs to follow to 127.0.0.1:8080.
PUBLIC_BASE_URL in the production .env should reflect the public
hostname (unaffected by the internal port change).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -87,14 +87,14 @@ RUN groupadd -g 10001 app \
 
 USER app
 
-EXPOSE 8000
+EXPOSE 8080
 
 # Phase 6 healthcheck: hits /healthz over the loopback with stdlib
 # urllib so we don't have to install curl/wget in the runtime image.
 # Intervals tuned for a small VM: probe every 30s, give a fresh
 # container 10s to finish startup before the first probe counts.
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
-    CMD python -c "import urllib.request,sys; urllib.request.urlopen('http://127.0.0.1:8000/healthz', timeout=2); sys.exit(0)" || exit 1
+    CMD python -c "import urllib.request,sys; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2); sys.exit(0)" || exit 1
 
 # Run Uvicorn directly. --proxy-headers + --forwarded-allow-ips make
 # Starlette's ProxyHeadersMiddleware trust X-Forwarded-* only from the
@@ -102,6 +102,6 @@ HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
 # image; local hot-reload is a dev concern and runs outside Docker.
 CMD ["uvicorn", "app.main:app", \
      "--host", "0.0.0.0", \
-     "--port", "8000", \
+     "--port", "8080", \
      "--proxy-headers", \
      "--forwarded-allow-ips", "127.0.0.1"]

docker-compose.yml

@@ -21,10 +21,10 @@ services:
     env_file:
       - .env
     ports:
-      # Uvicorn listens on 8000 inside the container. In the production
-      # topology Caddy fronts this; for local runs it's directly on the
-      # host loopback via the mapped port.
-      - "8000:8000"
+      # Uvicorn listens on 8080 inside the container (prod default). In
+      # the production topology Caddy fronts this; for local runs it's
+      # directly on the host loopback via the mapped port.
+      - "8080:8080"
     volumes:
       # SQLite DB + media uploads live under data/. Mounting it keeps
       # state on the host so container rebuilds don't wipe content.

run_dev.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# ---------------------------------------------------------------------------
+# Chicken Babies R Us — local dev launcher.
+#
+# Runs uvicorn directly on the host (no docker). Used for fast iteration on
+# routes, templates, CSS, and middleware. Set APP_ENV=production in front
+# of this script if you want to smoke-test the prod-only code paths (HSTS,
+# JSON logs, prod-config guardrails).
+#
+# Usage:
+#   ./run_dev.sh                    # dev mode, reload on
+#   ./run_dev.sh --no-reload        # dev mode, reload off
+#   PORT=8001 ./run_dev.sh          # override listen port (default 8000)
+# ---------------------------------------------------------------------------
+set -euo pipefail
+
+# Anchor paths to the repo root so the script works from any cwd.
+cd "$(dirname "$0")"
+
+VENV_DIR="venv"
+PYTHON_BIN="${PYTHON_BIN:-python3.12}"
+PORT="${PORT:-8080}"
+HOST="${HOST:-127.0.0.1}"
+
+# 1. Virtualenv -------------------------------------------------------------
+if [[ ! -x "${VENV_DIR}/bin/python" ]]; then
+  echo "==> Creating venv at ${VENV_DIR}/"
+  "${PYTHON_BIN}" -m venv "${VENV_DIR}"
+fi
+# shellcheck disable=SC1091
+source "${VENV_DIR}/bin/activate"
+
+# 2. Requirements (reinstall if requirements.txt is newer than the stamp) ---
+STAMP="${VENV_DIR}/.requirements.stamp"
+if [[ requirements.txt -nt "${STAMP}" ]]; then
+  echo "==> Installing / updating dependencies"
+  pip install --quiet --upgrade pip
+  pip install --quiet -r requirements.txt
+  touch "${STAMP}"
+fi
+
+# 3. .env ------------------------------------------------------------------
+if [[ ! -f .env ]]; then
+  echo "==> No .env found; copying from .env.example"
+  cp .env.example .env
+  echo "    Edit .env to set SECRET_KEY / RESEND_API_KEY / HCAPTCHA_* as needed."
+fi
+
+# 4. Data dir --------------------------------------------------------------
+mkdir -p data/media data/backups
+
+# 5. Launch ----------------------------------------------------------------
+RELOAD_FLAG="--reload"
+if [[ "${1:-}" == "--no-reload" ]]; then
+  RELOAD_FLAG=""
+fi
+
+echo "==> uvicorn on http://${HOST}:${PORT}  (APP_ENV=${APP_ENV:-development})"
+# shellcheck disable=SC2086
+exec uvicorn app.main:app \
+  --host "${HOST}" \
+  --port "${PORT}" \
+  ${RELOAD_FLAG} \
+  --proxy-headers \
+  --forwarded-allow-ips 127.0.0.1