Add documents volume mount + harden compose health checks

Mount ${MEDIA_ROOT}/local/documents:/media/local/documents:rw on the
media-api service so the document upload route can write PDFs to
disk. Without this mount, uploads fail on fresh deployments.

Also hardens several depends_on entries from service_started to
service_healthy (redis for media-api, api for admin, listmonk-app
for listmonk-init, gitea-db for gitea, nginx for newt) so
containers wait for actual readiness, not just process start.

Bunker Admin

docker-compose.prod.yml

@@ -197,6 +197,7 @@ services:
       - ${MEDIA_ROOT:-./media}/local/inbox:/media/local/inbox:rw
       - ${MEDIA_ROOT:-./media}/local/thumbnails:/media/local/thumbnails:rw
       - ${MEDIA_ROOT:-./media}/local/photos:/media/local/photos:rw
+      - ${MEDIA_ROOT:-./media}/local/documents:/media/local/documents:rw
       - ${MEDIA_ROOT:-./media}/public:/media/public:rw
     deploy:
       resources:
@@ -209,6 +210,8 @@ services:
     depends_on:
       v2-postgres:
         condition: service_healthy
+      redis:
+        condition: service_healthy
     logging: *default-logging
     networks:
       - changemaker-lite
@@ -235,7 +238,8 @@ services:
       - VITE_DOMAIN=${DOMAIN:-cmlite.org}
       - VITE_MKDOCS_SITE_PORT=${MKDOCS_SITE_SERVER_PORT:-4004}
     depends_on:
-      - api
+      api:
+        condition: service_healthy
     logging: *default-logging
     networks:
       - changemaker-lite
@@ -471,7 +475,7 @@ services:
     container_name: listmonk-init
     depends_on:
       listmonk-app:
-        condition: service_started
+        condition: service_healthy
     restart: "no"
     environment:
       PGPASSWORD: ${LISTMONK_DB_PASSWORD:?LISTMONK_DB_PASSWORD must be set in .env}
@@ -706,7 +710,8 @@ services:
       - "127.0.0.1:${GITEA_WEB_PORT:-3030}:3000"
       - "127.0.0.1:${GITEA_SSH_PORT:-2222}:22"
     depends_on:
-      - gitea-db
+      gitea-db:
+        condition: service_healthy
     logging: *default-logging
     networks:
       - changemaker-lite
@@ -1187,7 +1192,8 @@ services:
       - NEWT_ID=${PANGOLIN_NEWT_ID}
       - NEWT_SECRET=${PANGOLIN_NEWT_SECRET}
     depends_on:
-      - nginx
+      nginx:
+        condition: service_healthy
     logging: *default-logging
     networks:
       - changemaker-lite

docker-compose.yml

@@ -206,6 +206,7 @@ services:
       - ${MEDIA_ROOT:-./media}/local/inbox:/media/local/inbox:rw
       - ${MEDIA_ROOT:-./media}/local/thumbnails:/media/local/thumbnails:rw
       - ${MEDIA_ROOT:-./media}/local/photos:/media/local/photos:rw
+      - ${MEDIA_ROOT:-./media}/local/documents:/media/local/documents:rw
       - ${MEDIA_ROOT:-./media}/public:/media/public:rw
     deploy:
       resources:
@@ -218,6 +219,8 @@ services:
     depends_on:
       v2-postgres:
         condition: service_healthy
+      redis:
+        condition: service_healthy
     logging: *default-logging
     networks:
       - changemaker-lite
@@ -250,7 +253,8 @@ services:
       - ./admin:/app
       - /app/node_modules
     depends_on:
-      - api
+      api:
+        condition: service_healthy
     logging: *default-logging
     networks:
       - changemaker-lite
@@ -488,7 +492,7 @@ services:
     container_name: listmonk-init
     depends_on:
       listmonk-app:
-        condition: service_started
+        condition: service_healthy
     restart: "no"
     environment:
       PGPASSWORD: ${LISTMONK_DB_PASSWORD:?LISTMONK_DB_PASSWORD must be set in .env}
@@ -725,7 +729,8 @@ services:
       - "127.0.0.1:${GITEA_WEB_PORT:-3030}:3000"
       - "127.0.0.1:${GITEA_SSH_PORT:-2222}:22"
     depends_on:
-      - gitea-db
+      gitea-db:
+        condition: service_healthy
     logging: *default-logging
     networks:
       - changemaker-lite
@@ -1206,7 +1211,8 @@ services:
       - NEWT_ID=${PANGOLIN_NEWT_ID}
       - NEWT_SECRET=${PANGOLIN_NEWT_SECRET}
     depends_on:
-      - nginx
+      nginx:
+        condition: service_healthy
     logging: *default-logging
     networks:
       - changemaker-lite