Pass NEXT_PUBLIC_* as build args; verify deploy health before declaring success
The Docker build runs in GitHub Actions with no NEXT_PUBLIC_* present, so the client bundle inlined `undefined` for the Supabase URL and key. Browser-side components (positions/trade-history, sell/sell-recommendations) call
The Docker build runs in GitHub Actions with no NEXT_PUBLIC_* present, so the client bundle inlined undefined for the Supabase URL and key. Browser-side components (positions/trade-history, sell/sell-recommendations) call getSupabase() directly and threw on every render. Server API routes were unaffected because they read runtime env from Coolify.
These two values are public by definition, which is the one case where a build arg is correct — no non-NEXT_PUBLIC secret is passed.
Also adds a post-deploy health gate. Deploy previously reported success as soon as Coolify accepted the request, so a container serving Unauthorized on every request still showed green. It now polls /api/positions for a real 200 and alerts Discord on failure.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>