Sync with canonical matcha/phast@69bbbab and run on Fly as phast-app

The 2026-10-14 port took tea-mcp/src/phast, an older copy (light design, no OAuth).
This merges matcha/phast main with its history: the black/orange phast.app and
my.phast.app pages, and the Teahub-OAuth MCP server. On top, for prod:

- server.py serves phast.app / and my.phast.app / from this repo (no copies), and /healthz
- Dockerfile + start.sh: volume at /data, app runs unprivileged
- fly.toml: phast-app, volume phast_data, GITEA_URL=https://teahub.xyz

Dockerfile

@@ -3,10 +3,10 @@ ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
 WORKDIR /app
 COPY requirements.txt ./
 RUN pip install --no-cache-dir -r requirements.txt
-COPY server.py registry.py index.html phast.json ./
+COPY server.py registry.py index.html phast.json start.sh ./
+COPY my/index.html my/index.html
 ARG SOURCE_SHA=unknown
 ENV SOURCE_SHA=$SOURCE_SHA
-RUN useradd --create-home --uid 10001 phast
-USER phast
+RUN useradd --create-home --uid 10001 phast && chmod +x start.sh
 EXPOSE 8080
-CMD ["python", "server.py"]
+CMD ["./start.sh"]