Add a health check for the daemon and RPC endpoint (#34)

* Add a health check for the daemon and RPC endpoint

SeafileClient.is_healthy() checks seaf-cli status and makes a real RPC
call (get_repo_list) against the daemon's Unix socket - neither needs
the Seafile server, so it works without a token or password.

healthcheck.py exposes it as a plain script for Docker's HEALTHCHECK.
Each check is a fresh process spawned by the Docker daemon as root,
unlike the long-lived start.py process, so it drops to the seafile
user with runuser before touching the RPC socket - the one place that
mechanism still belongs after the earlier in-process privilege drop.

Verified against the real image: healthcheck.py exits 0 once the real
daemon is up (through the actual main() entrypoint, not a test
fixture) and nonzero when no daemon has been started.

* Assert the return value in the daemon-down health check test

Copilot review: the test checked the RPC call was skipped but not
what is_healthy() actually returned in that case.

---------

Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>

Dockerfile

@@ -61,9 +61,10 @@ RUN pip install --no-cache-dir --upgrade "setuptools>=78.1.1" && \
 # Copy app
 COPY dsc ./dsc/
 COPY start.py ./start.py
+COPY healthcheck.py ./healthcheck.py
 
 # Create seafile user and init seafile client
-RUN chmod +x /dsc/start.py && \
+RUN chmod +x /dsc/start.py /dsc/healthcheck.py && \
     useradd -U -d /dsc -s /bin/bash seafile && \
     usermod -G users seafile && \
     mkdir -p /dsc/seafile-data && \
@@ -74,11 +75,19 @@ RUN chmod +x /dsc/start.py && \
 RUN seaf-cli --help | grep -q 'download-by-name' && \
     seaf-cli sync --help | grep -q '\--token' && \
     seaf-cli list --help | grep -q '\--json' && \
-    python3 -c "import seafile, pysearpc, dsc.client, dsc.misc"
+    python3 -c "import seafile, pysearpc, dsc.client, dsc.misc, healthcheck"
 
 # Record the pinned client version in the image so it can be checked at
 # runtime; seaf-cli itself has no --version flag.
 ENV SEAFILE_CLI_VERSION=${SEAFILE_CLI_VERSION}
 
 VOLUME /dsc/seafile-data
+
+# The container's own process already runs as the seafile user (see
+# dsc.misc.drop_privileges), but a HEALTHCHECK is a fresh process started by
+# the Docker daemon, which starts it as root. runuser drops it to the same
+# unprivileged user before it ever touches the RPC socket.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=3 \
+    CMD runuser -u seafile -- python3 /dsc/healthcheck.py
+
 CMD ["./start.py"]