fix: bind port 7860 BEFORE backend health checks

HF Space shows 404 if the EXPOSE'd port isn't bound quickly after
container start. Previously entry.py waited up to 40s for gateway and
WebUI BFF health checks before binding port 7860 — too slow.

Now: bind 7860 first, then start watchdog + health checks in background
threads. This ensures HF routing sees the port immediately.

entry.py

@@ -879,6 +879,16 @@ def main():
     _ensure_persistent_storage()
     logger.info("Persistent storage ready at %s", DATA_DIR)
 
+    # Start HTTP proxy server FIRST (before background checks)
+    # HF Space requires the EXPOSE'd port to be bound quickly,
+    # otherwise it shows a 404 page even though the container is RUNNING.
+    try:
+        server = ThreadingHTTPServer(("0.0.0.0", 7860), ProxyHandler)
+        logger.info("Proxy listening on :7860")
+    except OSError as e:
+        logger.error("FATAL: Cannot bind port 7860: %s", e)
+        sys.exit(1)
+
     # Start log tailer thread
     tailer = threading.Thread(target=_log_tailer, daemon=True)
     tailer.start()
@@ -889,53 +899,31 @@ def main():
     watchdog.start()
     logger.info("Python gateway watchdog started")
 
-    # Check if backend services are reachable
-    for attempt in range(10):
-        try:
-            urllib.request.urlopen(f"{GATEWAY_URL}/health", timeout=2)
-            logger.info("Gateway reachable at %s", GATEWAY_URL)
-            break
-        except Exception:
-            logger.warning("Gateway not ready (attempt %d/10)", attempt + 1)
-            time.sleep(2)
-
-    for attempt in range(10):
-        try:
-            urllib.request.urlopen(f"{WEBUI_BFF_URL}/health", timeout=2)
-            logger.info("WebUI BFF reachable at %s", WEBUI_BFF_URL)
-            break
-        except Exception:
-            logger.warning("WebUI BFF not ready (attempt %d/10)", attempt + 1)
-            time.sleep(2)
-
-    # Start HTTP proxy server
-    try:
-        server = ThreadingHTTPServer(("0.0.0.0", 7860), ProxyHandler)
-    except OSError as e:
-        if "Address already in use" in str(e):
-            logger.error("FATAL: Port 7860 is already in use! Attempting to free it...")
-            # Try to find and kill whatever is using port 7860
+    # Check if backend services are reachable (non-blocking, best-effort)
+    # This runs in a background thread so it doesn't delay serve_forever()
+    def _wait_for_backends():
+        for attempt in range(10):
             try:
-                for conn in psutil.net_connections(kind='inet'):
-                    if conn.laddr.port == 7862 and conn.status == 'LISTEN':
-                        logger.info("Killing process %d on port 7862", conn.pid)
-                        psutil.Process(conn.pid).kill()
+                urllib.request.urlopen(f"{GATEWAY_URL}/health", timeout=2)
+                logger.info("Gateway reachable at %s", GATEWAY_URL)
+                break
+            except Exception:
                 time.sleep(2)
-                server = ThreadingHTTPServer(("0.0.0.0", 7860), ProxyHandler)
-                logger.info("Port 7860 freed successfully, proxy started")
+        for attempt in range(10):
+            try:
+                urllib.request.urlopen(f"{WEBUI_BFF_URL}/health", timeout=2)
+                logger.info("WebUI BFF reachable at %s", WEBUI_BFF_URL)
+                break
             except Exception:
-                logger.error("Could not free port 7860, aborting")
-                sys.exit(1)
-        else:
-            raise
+                time.sleep(2)
+    threading.Thread(target=_wait_for_backends, daemon=True).start()
 
+    # Start serving (this blocks forever)
     try:
-        logger.info("Proxy listening on :7860")
         logger.info("  / → Dashboard")
         logger.info("  /webui → hermes-web-ui")
         logger.info("  /api/* → proxy to WebUI BFF (:6060)")
         logger.info("  /v1/* → proxy to WebUI BFF (:6060)")
-
         server.serve_forever()
     except Exception as e:
         logger.error("FATAL: Proxy server error: %s", e)