fix: auto-fix code quality [skip ci]

infra/compose/llm-api.yml

@@ -1,3 +1,7 @@
+# ── llm-api service (Rust GGUF inference) ──
+# Model file is mounted from host; healthcheck tolerates HTTP 404 (exit 22)
+# from curl to confirm the server is alive regardless of endpoint availability.
+
 services:
   llm-api:
     container_name: llm-api

infra/docker/llm-api.Dockerfile

@@ -1,7 +1,8 @@
 # ── Build stage: cargo-chef ──
 FROM lukemathwalker/cargo-chef:latest-rust-1.89.0 AS chef
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    libclang-dev cmake \
+    libclang-dev \
+    cmake \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 
@@ -23,6 +24,8 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
 
 # ── Runtime image ──
 FROM debian:bookworm-slim AS runtime
+# ca-certificates: TLS for API calls  |  curl: healthcheck  |  libssl3: TLS runtime dep
+# libgomp1: OpenMP parallelism for GGUF model inference
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     curl \
@@ -30,13 +33,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libgomp1 \
     && rm -rf /var/lib/apt/lists/*
 
+# Non-root user for security
 RUN groupadd -g 1001 appgroup && \
     useradd -u 1001 -g appgroup -s /bin/sh appuser
 
 WORKDIR /app
 COPY --from=builder /app/llm-api /app/llm-api
 
-# Model will be mounted at runtime
+# Model volume mount point (provided at runtime)
 RUN mkdir -p /root/models/gguf && chown -R appuser:appgroup /root/models/gguf
 
 USER appuser

infra/traefik/dynamic/apps.yaml

@@ -1,3 +1,7 @@
+# ── Traefik dynamic configuration (watched at runtime) ──
+# Routers map host rules to backend services; services resolve via Docker
+# internal DNS (container_name:port).
+
 http:
   routers:
     elysia:
@@ -59,6 +63,7 @@ http:
         Host(`scraper.asepharyana.web.id`) || Host(`api.asepharyana.web.id`)
       service: scraper-service
       tls: {}
+      # ── Backend service definitions ──
   services:
     elysia-service:
       loadBalancer:

infra/traefik/dynamic/ssl.yaml

@@ -1,3 +1,7 @@
+# ── TLS certificate configuration ──
+# Certificates are auto-renewed by the cert-manager sidecar.
+# asepharyana.my.id is the default certificate for all routes.
+
 tls:
   certificates:
     - certFile: /etc/traefik/certs/asepharyana.my.id.pem