fix(api): install + start cron-worker systemd service on deploy (#390)

Brings cron-worker online in production via systemd. Closes verify-api-cron.py liveness alert.

.github/workflows/deploy.yml

@@ -86,6 +86,14 @@ jobs:
             fi
             # Restart generic services
             sudo systemctl reload nginx || true
+            # Install and start the cron-worker systemd service (long-running scheduler)
+            if [ -f services/nginx/app/resources/cron-worker.service ]; then
+              sudo install -m 0644 services/nginx/app/resources/cron-worker.service /etc/systemd/system/cron-worker.service
+              sudo systemctl daemon-reload
+              sudo systemctl enable cron-worker || true
+              sudo systemctl restart cron-worker || true
+              echo "cron-worker status: $(sudo systemctl is-active cron-worker || echo unknown)"
+            fi
             echo "Deploy complete: $(git rev-parse --short HEAD)"
           '
 

services/nginx/app/resources/cron-worker.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=Truck Wash API cron worker (long-running scheduler)
+After=network-online.target php8.2-fpm.service redis.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+WorkingDirectory=/opt/copenhagentruckwash-api/services/nginx/app
+ExecStart=/usr/bin/php /opt/copenhagentruckwash-api/services/nginx/app/index.php run cron-worker
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=always
+RestartSec=10
+TimeoutStopSec=30
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=cron-worker
+
+# Hardening
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+ProtectHome=true
+ReadWritePaths=/opt/copenhagentruckwash-api/services/php/logs
+
+# Resource limits
+LimitNOFILE=65536
+MemoryMax=512M
+
+[Install]
+WantedBy=multi-user.target