v0.9.1 — Self-update: 403 on trigger mismatch + reliability

webhook returns 200 even when a trigger rule isn't satisfied, which would let
the app's res.ok check falsely report success if the secret drifted. Set
trigger-rule-mismatch-http-response-code: 403 so unauthorized triggers are
clearly rejected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-entrypoint.sh

@@ -11,4 +11,7 @@ echo "Postgres is ready."
 echo "Running Prisma migrations..."
 ./node_modules/.bin/prisma migrate deploy
 
+echo "Running Location-spine backfill (idempotent)..."
+./node_modules/.bin/tsx prisma/scripts/backfill-locations.ts || echo "  Backfill skipped/failed (non-fatal); check logs."
+
 exec "$@"