feat: add fitdata Nomad job

Static port 5311 for MCP access (5/3/1 reference).
OIDC protected via Traefik middleware.

Setup: sudo mkdir -p /data/services/fitdata && sudo chown 1000:1000 /data/services/fitdata

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

services/fitdata.hcl

@@ -0,0 +1,74 @@
+# ABOUTME: Nomad job for Fitdata - fitness data analysis and MCP server.
+# ABOUTME: Runs FastHTML Python app with SQLite, static port for MCP access.
+
+# Setup required before running:
+#   sudo mkdir -p /data/services/fitdata && sudo chown 1000:1000 /data/services/fitdata
+
+job "fitdata" {
+  datacenters = ["alo"]
+
+  meta {
+    uuid = uuidv4()
+  }
+
+  update {
+    max_parallel      = 1
+    health_check      = "checks"
+    min_healthy_time  = "30s"
+    healthy_deadline  = "5m"
+    progress_deadline = "10m"
+    auto_revert       = true
+  }
+
+  group "web" {
+    network {
+      port "http" {
+        static = 5311
+      }
+    }
+
+    task "app" {
+      driver = "docker"
+      user   = "1000"
+
+      config {
+        image      = "gitea.v.paler.net/alo/fitdata:latest"
+        ports      = ["http"]
+        force_pull = true
+        volumes    = ["/data/services/fitdata:/var/lib/fitdata"]
+      }
+
+      env {
+        FITDATA_DATA_DIR = "/var/lib/fitdata"
+        FITDATA_DB_PATH  = "/var/lib/fitdata/fitdata.db"
+      }
+
+      resources {
+        memory = 512
+      }
+
+      service {
+        name = "fitdata"
+        port = "http"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.fitdata.entryPoints=websecure",
+          "traefik.http.routers.fitdata.middlewares=oidc-auth@file",
+        ]
+
+        check {
+          type     = "http"
+          path     = "/healthz"
+          interval = "10s"
+          timeout  = "5s"
+
+          check_restart {
+            limit = 3
+            grace = "60s"
+          }
+        }
+      }
+    }
+  }
+}