fix: start sac-api via /usr/bin/bash to avoid systemd 203/EXEC

ExecStart no longer relies on shebang when CRLF slips into deploy scripts.
sac-deploy strips CR from all deploy/*.sh and waits for active before health check.

deploy/sac-deploy.sh

@@ -98,6 +98,11 @@ if [ -f "${START_SH}" ]; then
  sed -i 's/\r$//' "${START_SH}"
  chmod 755 "${START_SH}"
 fi
+for _sh in "${APP_ROOT}"/deploy/sac-deploy.sh "${APP_ROOT}"/deploy/systemd/*.sh; do
+ [ -f "${_sh}" ] || continue
+ sed -i 's/\r$//' "${_sh}"
+ chmod 755 "${_sh}" 2>/dev/null || true
+done
 
 log "Проверка DATABASE_URL (как у uvicorn через SAC_CONFIG_FILE)"
 sudo -u "${APP_USER}" bash -c "
@@ -131,7 +136,14 @@ finally:
 \"
 "
 systemctl restart "${SERVICE_NAME}"
-systemctl is-active --quiet "${SERVICE_NAME}" || die "${SERVICE_NAME} не active"
+sleep 2
+for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
+ if systemctl is-active --quiet "${SERVICE_NAME}"; then
+  break
+ fi
+ sleep 1
+done
+systemctl is-active --quiet "${SERVICE_NAME}" || die "${SERVICE_NAME} не active — journalctl -u ${SERVICE_NAME} -n 40 --no-pager"
 
 HEALTH_OK=0
 for _ in 1 2 3 4 5 6; do

deploy/systemd/sac-api.service

@@ -13,7 +13,7 @@ WorkingDirectory=/opt/security-alert-center/backend
 # Конфиг читает само приложение (pydantic), не systemd — иначе ломаются пароли с #, $ и т.д.
 Environment=SAC_CONFIG_FILE=/opt/security-alert-center/config/sac-api.env
 Environment=PYTHONPATH=/opt/security-alert-center/backend
-ExecStart=/opt/security-alert-center/deploy/systemd/sac-api-start.sh
+ExecStart=/usr/bin/bash /opt/security-alert-center/deploy/systemd/sac-api-start.sh
 Restart=on-failure
 RestartSec=5
 TimeoutStopSec=20