fix(hosted): run the eSignet seeder once (#31)

Coolify gives a service that declares no restart policy `unless-stopped`,
so the seeder exits 0 on success and is started again forever. Every other
one-shot in the fleet already says `no`.

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

compose.coolify.esignet.yaml

@@ -101,6 +101,7 @@ services:
 
   esignet-seed:
     image: ${SOLMARA_ESIGNET_SEED_IMAGE:?set digest-pinned eSignet seed image}
+    restart: "no"
     environment:
       PGHOST: esignet-database
       PGUSER: esignet

scripts/test_runtime_topology.py

@@ -791,6 +791,15 @@ def test_hosted_esignet_is_standalone_and_core_portal_owns_login_config(
         )
         self.assertNotIn("NIA_ESIGNET_CLIENT_PRIVATE_JWK", portal)
 
+    def test_hosted_esignet_seeder_runs_once(self) -> None:
+        """Coolify gives a service that declares no restart policy
+        `unless-stopped`, so a one-shot that exits on success is started again
+        forever. Every other one-shot in the fleet says `no`; the seeder must
+        too."""
+        esignet_path = SCRIPT.parents[1] / "compose.coolify.esignet.yaml"
+        esignet = yaml.safe_load(esignet_path.read_text(encoding="utf-8"))
+        self.assertEqual(esignet["services"]["esignet-seed"].get("restart"), "no")
+
     def test_bruno_workspace_covers_only_the_eight_governed_v2_lookups(self) -> None:
         relay_requests = SCRIPT.parents[1] / "requests/registry-lab/50 - Relay V2"
         rendered = "\n".join(