Implement socket-activated zero-downtime deploy switchover

[retlehs]

Summary

• Implement systemd socket activation for zero-downtime deploy switchover
• Add Go-side LISTEN_FDS detection with fallback to normal listen for local dev
• Bump Caddy retry window (lb_try_duration 5s→10s, lb_try_interval 250ms→100ms) as safety net

Why

We were seeing brief 502/503 responses during deploy because restarting the service drops the listening socket. Socket activation (wppackages.socket) keeps the socket open across service restarts — incoming connections queue at the kernel instead of failing.

Builds on #95 which separated Litestream into its own service, unblocking socket activation (the old litestream -exec wrapper wouldn't pass through the socket fd).

Changes

• internal/http/server.go — systemdListener() consumes the fd passed by systemd via LISTEN_FDS/LISTEN_PID; falls back to ListenAndServe when not socket-activated (local dev)
• templates/wppackages.socket.j2 — new systemd socket unit listening on {{ go_listen_addr }}
• templates/wppackages.service.j2 — adds Requires=wppackages.socket
• tasks/main.yml — deploys and enables the socket unit before the service
• Caddyfile.j2 — retry tuning as additional safety net

Test plan

• Run provision and verify wppackages.socket is active (systemctl status wppackages.socket)
• Confirm wppackages.service starts via socket activation (journalctl -u wppackages shows "using systemd socket activation")
• Run deploy and monitor for 502/503 elimination during switchover
• Verify local dev still works without socket activation (normal make dev)

🤖 Generated with Claude Code

[swalkinshaw]

🤔 not sure this is entirely correct or solves the problem. I think partly its because we're wrapping the Go command with litestream -exec when really we should separate out litestream into its own service. In fact litestream might not even pass through the socket fd to our binary...

Assuming we separate them, not even sure the readiness checks in Ansible are needed or the Caddy retries 🤔

[swalkinshaw]

Though the readiness checks aren't bad anyway just to be safe