fix: exit cleanly on fatal startup errors instead of crash-looping (#4253)

[apotema]

Problem

Fixes #4253. After Migration complete, a fatal error in the server startup window did not terminate the process. Background handles — the ioredis reconnect loop, open sockets — keep the event loop alive, so instead of exiting, the process spins at high CPU, never passes the healthcheck (/api/trpc/settings.health), and Docker Swarm crash-loops the container showing only:

Using Docker socket (Standard Docker socket): /var/run/docker.sock
ELIFECYCLE  Command failed.

This matches every detail the reporter described: the crash loop pegging CPU (their 700–900%), the server never reaching "Server Started", and Swarm marking the task non-zero exit (1): unhealthy container.

Root cause

In apps/dokploy/server/server.ts:

• The top-level setupDirectories() / createDefaultTraefikConfig() block had no try/catch.
• app.prepare() had error handling inside its .then() but no .catch() — a rejected prepare() became an unhandled rejection.
• There were no process-level uncaughtException / unhandledRejection handlers, and a dependency registers a logging-only unhandledRejection listener that suppresses Node's default "crash on unhandled rejection". So a fatal startup error is logged (or not) but the process never exits — it just spins.

Fix

Phase-gated error handling, so a failed startup exits cleanly without destabilizing a healthy server:

• Before the HTTP server is listening → an uncaught exception / unhandled rejection / sync-init throw / prepare() rejection / bind failure logs the cause and exit(1)s, so the orchestrator restarts cleanly instead of spinning.
• After it is listening → a stray unhandled rejection is only logged, so an otherwise-healthy serving instance is never killed.
• await the listen() bind so a bind failure (e.g. EADDRINUSE) exits instead of spinning; mark the server ready only once actually listening.
• try/catch around the synchronous directory/Traefik init; .catch() on app.prepare() with a labeled diagnostic.

Verification (real compiled bundle)

Built the real dist/migration.mjs + dist/server.mjs from this branch (node:24.4.0-slim, real Postgres 16 + Redis on a Docker network) and exercised the actual migration → server boot:

Scenario	canary	This PR
Pre-listen prepare() failure	spins forever, high CPU, killed at timeout (exit 124)	logs Failed to prepare…, clean exit 1 in ~5s
Normal boot	—	reaches Server Started on, healthcheck HTTP 200, running
Real post-listen rejection (docker.sock ENOENT)	—	logged, server survives and stays healthy

The post-listen case is why the handlers are phase-gated: a naive "always exit(1) on unhandled rejection" would kill a healthy server on that exact background docker.sock rejection.

Scope

This fixes the crash-loop mechanism — any fatal startup failure now produces a clean, logged exit(1) instead of a silent high-CPU spin. The separate report in the comments (the dokploy-postgres role disappearing after ~1–2h) is a distinct database-lifecycle issue this PR does not address; with this change, that failure would surface as a clean diagnostic exit rather than a silent spin.

Testing

• tsc --noEmit clean; biome check clean.
• Reproduced before/after with the real bundle as above.