fix: enable scanner HTTP service in combined image

The root Dockerfile bakes api + scanner + worker + beat into a single
container managed by supervisord, but the [program:scanner] entry was
shipped with autostart=false and the api/worker had no SCANNER_SERVICE_URL
in their environment, so run_scan tasks always got ConnectError trying to
reach http://localhost:8001.

Enable the scanner, point the api/worker/beat at the in-process scanner at
http://127.0.0.1:8001, and start the scanner before the api/worker so its
port is listening by the time scan tasks start running.

supervisord.conf

@@ -28,9 +28,10 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
 priority=200
+environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:worker]
-command=celery -A src.celery_app worker --loglevel=info --concurrency=2
+command=sh -c "SCANNER_SERVICE_URL=http://127.0.0.1:8001 celery -A src.celery_app worker --loglevel=info --concurrency=2"
 directory=/app
 autostart=true
 autorestart=true
@@ -41,9 +42,10 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=30
 killasgroup=true
 priority=300
+environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:beat]
-command=celery -A src.celery_app beat --loglevel=info
+command=sh -c "SCANNER_SERVICE_URL=http://127.0.0.1:8001 celery -A src.celery_app beat --loglevel=info"
 directory=/app
 autostart=true
 autorestart=true
@@ -54,17 +56,19 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
 priority=400
+environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:scanner]
 command=python -m src.worker
 directory=/app
-autostart=false
-autorestart=false
+autostart=true
+autorestart=true
+startsecs=10
 stdout_logfile=/dev/stdout
 stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
-priority=500
+priority=150
 environment=PYTHONUNBUFFERED="1"