G1: Veron 1 host live behind Cloudflare Tunnel

app.windygit.com / api.windygit.com / models.windygit.com are serving over
HTTPS with ZERO inbound ports open on Grant's network.

  - tunnel 4e856c5d, 4 registered edge connections, systemd-managed and bounded
  - three proxied single-level CNAMEs (Free Universal SSL covers them; a
    two-level name would need ACM and would die in the TLS handshake)
  - services bound to 127.0.0.1 with configurable host ports — Veron 1 is
    Grant's workstation and 3000/3300 belong to other projects
  - docs/RUNBOOK-VERON.md

I-12 PROVEN IN PRODUCTION: /version reports source=baked with a sha equal to
the deployed HEAD.

Also fixed: the tunnel health probe targeted localhost from inside a container,
so it was permanently red. A check that is always red is as useless as one that
is always green — it is how a fleet canary goes 37 days dead unnoticed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

SUBSTRATE.md

@@ -20,7 +20,7 @@ boot guard in `api/app/main.py` that refuses to start there in production.
 | Port | Service |
 |---|---|
 | 8600 | `windy-git-api` — our plane |
-| 3000 | Gitea |
+| **3080** | Gitea — host 3000 and 3300 are taken by resident projects on Veron 1 |
 | 5432 | Postgres |
 | 2000 | cloudflared metrics (probe target) |
 
@@ -30,7 +30,7 @@ Zone `windygit.com` = `9d8637dcac3415607b2116e6099fe567` · account `193b347aede
 
 | Hostname | → |
 |---|---|
-| `app.windygit.com` | Gitea :3000 — UI **and** git over HTTPS |
+| `app.windygit.com` | Gitea :3080 — UI **and** git over HTTPS |
 | `api.windygit.com` | our plane :8600 |
 | `models.windygit.com` | HF-compatible endpoint :8600 (v2) |
 | `windygit.com` | Cloudflare Pages — marketing, Grant-gated |