feat(infra): Fly config for node3 on the public OSS build

Deploys node3.gitlawb.com (Fly app gitlawb-node-3, nrt) from this repo's
Dockerfile instead of its old private source. Canary for migrating the
bootstrap nodes; node + node2 follow.

- region nrt, reuses volume gitlawb_data (identity + repos) and the
  attached Postgres (DATABASE_URL secret)
- corrects PUBLIC_URL to https://node3.gitlawb.com, bootstrap peers to
  node + node2 (not self), drops vestigial GITLAWB_DB (v0.3.9 is
  Postgres-only)
- 1024MB (was 256MB — too small for v0.3.9)

Migration note: the existing volume was created by the old root-based
image, so /data was root-owned; the public image runs as uid 1000 and
needed a one-time 'chown -R 1000:1000 /data'. node + node2 will need the
same until the image entrypoint self-heals ownership.

Co-Authored-By: OpenClaude <[email protected]>

infra/fly/node3.toml

@@ -0,0 +1,61 @@
+# Fly config for node3.gitlawb.com — deploys the public Gitlawb/node source.
+# Canary for migrating the bootstrap nodes onto the OSS build (node + node2 follow).
+# Deploy from the repo root:  fly deploy -a gitlawb-node-3 -c infra/fly/node3.toml
+#
+# Reuses the existing nrt volume `gitlawb_data` (identity key + repos) and the
+# attached Postgres `gitlawb-node-3-db` (via the DATABASE_URL app secret).
+app = "gitlawb-node-3"
+primary_region = "nrt"
+
+[build]
+  dockerfile = "../../Dockerfile"
+
+[env]
+  GITLAWB_HOST = "0.0.0.0"
+  GITLAWB_PORT = "7545"
+  GITLAWB_P2P_PORT = "7546"
+  GITLAWB_REPOS_DIR = "/data/repos"
+  GITLAWB_KEY = "/data/keys/identity.pem"
+  GITLAWB_PUBLIC_URL = "https://node3.gitlawb.com"
+  # Bootstrap to the other two production nodes (not self).
+  GITLAWB_BOOTSTRAP_PEERS = "https://node.gitlawb.com,https://node2.gitlawb.com"
+  GITLAWB_AUTO_SYNC = "true"
+  GITLAWB_MAX_PACK_BYTES = "524288000"
+
+[http_service]
+  internal_port = 7545
+  force_https = true
+  auto_stop_machines = false
+  auto_start_machines = true
+  min_machines_running = 1
+
+  [http_service.concurrency]
+    type = "connections"
+    hard_limit = 500
+    soft_limit = 400
+
+  [http_service.http_options]
+    # 120s, not 600: long idle windows let hung clients pin Fly's connection
+    # slots (hard_limit) — root factor in the 2026-06-12 prod outage
+    idle_timeout = 120
+
+[[services]]
+  protocol = "udp"
+  internal_port = 7546
+
+  [[services.ports]]
+    port = 7546
+
+[[vm]]
+  size = "shared-cpu-1x"
+  # 1024MB: node3 mirrors the whole network (2400+ repos). Its prior 256MB was
+  # far too small for v0.3.9; matches the gitlawb-node-test sizing.
+  memory = 1024
+
+[[mounts]]
+  source = "gitlawb_data"
+  destination = "/data"
+
+[metrics]
+  port = 9091
+  path = "/metrics"