Sync with canonical matcha/phast@69bbbab and run on Fly as phast-app

The 2026-10-14 port took tea-mcp/src/phast, an older copy (light design, no OAuth).
This merges matcha/phast main with its history: the black/orange phast.app and
my.phast.app pages, and the Teahub-OAuth MCP server. On top, for prod:

- server.py serves phast.app / and my.phast.app / from this repo (no copies), and /healthz
- Dockerfile + start.sh: volume at /data, app runs unprivileged
- fly.toml: phast-app, volume phast_data, GITEA_URL=https://teahub.xyz

fly.toml

@@ -4,20 +4,31 @@ primary_region = "iad"
 [build]
   dockerfile = "Dockerfile"
 
+[env]
+  GITEA_URL = "https://teahub.xyz"
+  PHAST_DATA_DIR = "/data/phast"
+  FASTMCP_HOME = "/data/fastmcp"
+  ALLOWED_GITEA_USERS = "matcha,chai"
+  PORT = "8080"
+  PHAST_HOST = "0.0.0.0"  # asyncio binds :: as IPv6-only; the Fly proxy arrives over IPv4
+
 [http_service]
   internal_port = 8080
   force_https = true
-  auto_stop_machines = "stop"
-  auto_start_machines = true
+  auto_stop_machines = "off"
   min_machines_running = 1
 
   [[http_service.checks]]
-    grace_period = "15s"
-    interval = "15s"
+    grace_period = "20s"
+    interval = "30s"
     method = "GET"
     path = "/healthz"
     timeout = "5s"
 
+[mounts]
+  source = "phast_data"
+  destination = "/data"
+
 [[vm]]
   memory = "512mb"
   cpu_kind = "shared"