fix(deploy+kiosk): server healthcheck wget, nodered spider, cloud discovery

- server Dockerfile installs wget — bookworm-slim doesn't include it
  by default, so the healthcheck CMD silently failed → Coolify marked
  the container unhealthy.
- nodered healthcheck swapped to /nrdp/ (always 200 when runtime up)
  via wget --spider; previous /nrdp/auth/login returned non-2xx when
  adminAuth disabled.
- start_period bumped to 90s for nodered's flow load on smaller hosts.
- Kiosk discovery: cloud fallback now frame-eu.betterportal.net per
  the managed-fleet endpoint.

deploy/docker/Dockerfile.server

@@ -24,7 +24,7 @@ FROM node:23-bookworm-slim
 
 # ffmpeg for camera snapshot capture (optional but needed for /admin/entities/:id/snapshot)
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates ffmpeg \
+    ca-certificates ffmpeg wget \
     && rm -rf /var/lib/apt/lists/*
 
 RUN useradd -m -d /var/lib/betterframe -s /bin/false betterframe

docker-compose.coolify.yml

@@ -68,11 +68,12 @@ services:
     expose:
       - "1880"
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:1880/nrdp/auth/login >/dev/null || exit 1"]
+      # Node-RED root admin path returns 200 once the runtime is up.
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:1880/nrdp/ || exit 1"]
       interval: 30s
       timeout: 5s
       retries: 3
-      start_period: 60s
+      start_period: 90s
     networks:
       - betterframe
 

docker-compose.yml

@@ -85,11 +85,11 @@ services:
     expose:
       - "1880"
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:1880/nrdp/auth/login >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:1880/nrdp/ || exit 1"]
       interval: 30s
       timeout: 5s
       retries: 3
-      start_period: 60s
+      start_period: 90s
     networks:
       - betterframe
 

kiosk/src/server.rs

@@ -73,10 +73,14 @@ pub fn discover_server(override_url: Option<&str>) -> String {
         }
     }
 
+    // Probe order: on-device → LAN mDNS → BetterCorp managed cloud.
+    // Single image works for aio (server beside kiosk on same Pi), on-prem
+    // (server on the LAN, discoverable by mDNS), and client-only (no local
+    // server — falls through to the cloud).
     let candidates = [
         "http://localhost",
         "http://betterframe.local",
-        "https://frame.betterportal.cloud",
+        "https://frame-eu.betterportal.net",
     ];
 
     for url in candidates {