Infra: Auto-deploy monitor-api via GHCR + Watchtower

[xavierlyu]

Problem

Every deploy to the VPS is manual: SSH in, git pull, docker compose up --build -d. Unsustainable.

Suggested fix: publish api/Dockerfile to GHCR on every main push, let Watchtower poll and restart the container automatically. Reference: https://github.com/nicholas-fedor/watchtower

Work

1. Add .github/workflows/publish-api.yml

• Trigger: push to main with changes under api/
• Log in to ghcr.io via GITHUB_TOKEN, build and push
  ghcr.io/latent-to/cacheon/monitor-api:latest (+ :<sha> tag for rollback)

2. Update validator/docker-compose.yml

• Replace build: block in monitor-api with image: ghcr.io/latent-to/cacheon/monitor-api:latest
• Add a watchtower service (poll interval 60 s, WATCHTOWER_CLEANUP=true, scoped to Cacheon containers via label so it never touches eval GPU pods)

3. One-time VPS setup

• docker login ghcr.io once so Watchtower can pull
• docker compose pull && docker compose up -d to bootstrap