chore: remove the Python service; Python is the training stack only

Phase 4 of docs/RUST_REWRITE.md. Since 2026-10-18 ping-collector (rust/)
collects, forecasts, notifies (ntfy + Matrix) and serves the website/API;
nothing in production ran the Python service code any more.

Removed (~17k lines): the FastAPI app (web_api, schemas, health_check,
metrics, postgres_history, forecast_history, thaiwater), the Python RID
collector and CLI (water_scraper_v3, main, run.py), the notifier and Matrix
alerting (notify, alerting), the multi-backend adapters (SQLite, MySQL,
InfluxDB, VictoriaMetrics) with demo databases, models/validators/exceptions/
logging/rate limiter, ml/skill.py (served by Rust now), the migration tooling
(api_parity, collector_parity, e2e_notify, install_collector.sh,
gen_notify_cases.py, spikes/rust-forecast), Docker/compose/Grafana files,
sql/, the release workflow and the docs for all of that. Their tests went
with them.

Kept in Python: src/ml (training, evaluation harness, export; predict.py as
the reference the Rust forecaster is tested against), the HII and RID-dam
clients/stores for the archive backfills (their live collectors removed),
the backfill scripts, retrain.sh + timer, forecast_parity.py.

- PostgreSQL only: src/config.py is database_url() from POSTGRES_* / .env;
  the stores lost their sqlite/mysql branches (and the 2026-08 column
  migration). The database tests run against a throwaway schema from
  TEST_DATABASE_URL (tests/conftest.py pg_url, skipped without it), as the
  Rust tests do; CI gets a PostgreSQL service. 100 tests (66 without a DB).
- The notifier settings moved from src/notify.py into src/ml/export.py;
  flood_config.json regenerates byte-identical.
- tests/test_dashboard.py checks every path the dashboard fetches against
  ping-collector's router.
- Dependencies: fastapi, uvicorn, pydantic, influxdb, pymysql, psutil,
  schedule, sphinx, pyinstaller, mypy, pytest-asyncio dropped; python-dotenv
  1.1.1 explicit (it came in through uvicorn[standard]).
- Formatting contract extended to scripts/ and tests/ (reformatted once).
- scripts/install.sh is the one installer (fresh host or update, in place in
  a checkout without touching its ownership): binary, units, uv sync, .env
  defaults, removes the retired water-monitor.service and any old
  --alert-check cron job, dry run + forecast check, restart, readiness wait.
- Docs, CLAUDE.md, CONTRIBUTING.md, .env.example, Makefile, unit comments
  and Rust doc comments updated to the Rust service.

.gitea/workflows/ci.yml

@@ -1,13 +1,13 @@
 name: CI
 
-# What this checks, on every push and PR to master:
+# The Python side (src/ml training/evaluation stack, archive backfills), on
+# every push and PR to master:
 #   1. formatting contract (black + isort, config in pyproject.toml)
 #   2. flake8 hard-error gate (syntax, undefined names)
-#   3. the pytest suite (synthetic data, no DB/network; ~1 min)
-# Docker build / staging / production / perf jobs from the original template
-# were removed: there is no registry, no staging host, and production is a
-# systemd unit deployed by `git pull` on the server (docs/FLOOD_FORECASTING.md
-# section 6, scripts/install.sh). Re-add a job when the thing it deploys exists.
+#   3. the pytest suite: synthetic data, no network; the database tests run
+#      against a throwaway PostgreSQL service (TEST_DATABASE_URL, as in rust.yml)
+# The service itself (ping-collector) is checked by rust.yml. Production is a
+# systemd unit deployed by `git pull` + scripts/install.sh on the server.
 
 on:
   push:
@@ -15,7 +15,7 @@ on:
   pull_request:
     branches: [master]
   schedule:
-    # daily, catches dependency drift / upstream API changes in the tests
+    # daily, catches dependency drift
     - cron: "0 2 * * *"
   workflow_dispatch:
 
@@ -41,17 +41,30 @@ jobs:
           pip install --root-user-action=ignore black==26.5.1 isort==5.12.0 flake8==6.1.0
 
       - name: black
-        run: black --check --diff src/ *.py
+        run: black --check --diff src/ scripts/ tests/ rust/forecast/testdata rust/collector/testdata
 
       - name: isort
-        run: isort --check-only --diff src/ *.py
+        run: isort --check-only --diff src/ scripts/ tests/
 
       - name: flake8 (errors only)
-        run: flake8 src/ --count --select=E9,F63,F7,F82 --show-source --statistics
+        run: flake8 src/ scripts/ tests/ --count --select=E9,F63,F7,F82 --show-source --statistics
 
   test:
     name: Test suite
     runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: ping
+          POSTGRES_DB: ping
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 20
+    env:
+      TEST_DATABASE_URL: postgres://postgres:ping@postgres:5432/ping
     steps:
       - uses: actions/checkout@v4
 
@@ -66,10 +79,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip --root-user-action=ignore
-          pip install --root-user-action=ignore -r requirements.txt
-          pip install --root-user-action=ignore pytest==9.1.1 pytest-asyncio==0.21.1
+          pip install --root-user-action=ignore -r requirements.txt pytest==9.1.1
 
       - name: pytest
-        env:
-          DB_TYPE: sqlite
-        run: pytest -q -p no:cacheprovider
+        run: pytest -q -p no:cacheprovider -rs

.gitea/workflows/docs.yml

@@ -1,36 +1,23 @@
 name: Docs
 
-# Checks that the documentation the project actually ships stays consistent:
-#   - every relative link / image path in docs/*.md and README.md resolves
-#     inside the repo (external URLs are NOT fetched: localhost examples,
-#     rate-limited hosts and the Tailscale-era links made that gate permanently
-#     red, and a 200 on a curl --head proves nothing about a doc anyway)
-#   - the FastAPI app imports and its OpenAPI schema is exportable (that is
-#     the reference at https://water.buildfor.life/docs)
-# The previous Sphinx/apidoc jobs produced artifacts nobody read and were
-# removed. Reference docs live in docs/*.md; the public overview is at
-# https://buildfor.life/docs/tooling/ping-river-monitor/.
+# Every relative link / image path in the shipped Markdown (README, CLAUDE,
+# CONTRIBUTING, rust/README, docs/) resolves inside the repo. External URLs
+# are NOT fetched: localhost examples and rate-limited hosts made that gate
+# permanently red, and a 200 proves nothing about a doc anyway. The API
+# reference (/docs, /openapi.json) is generated by ping-collector from its
+# route table and tested in rust/collector/src/web/tests.rs.
 
 on:
   push:
     branches: [master, develop]
     paths:
-      - "docs/**"
-      - "README.md"
-      - "CONTRIBUTING.md"
-      - "src/web_api.py"
-      - "src/schemas.py"
+      - "**.md"
       - ".gitea/workflows/docs.yml"
   pull_request:
     paths:
-      - "docs/**"
-      - "README.md"
-      - "CONTRIBUTING.md"
+      - "**.md"
   workflow_dispatch:
 
-env:
-  PYTHON_VERSION: "3.11"
-
 jobs:
   docs:
     name: Validate documentation
@@ -43,7 +30,8 @@ jobs:
           python3 - <<'PY'
           import re, sys, pathlib
           root = pathlib.Path(".")
-          files = [root / "README.md", root / "CONTRIBUTING.md", *root.glob("docs/**/*.md")]
+          files = [root / "README.md", root / "CLAUDE.md", root / "CONTRIBUTING.md",
+                   root / "rust" / "README.md", *root.glob("docs/**/*.md")]
           link = re.compile(r"!?\[[^\]]*\]\(([^)\s]+)(?:\s+\"[^\"]*\")?\)")
           bad = []
           for md in files:
@@ -65,35 +53,3 @@ jobs:
               sys.exit(1)
           print(f"checked {len(files)} files, all relative links resolve")
           PY
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
-          cache: pip
-          cache-dependency-path: requirements.txt
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip --root-user-action=ignore
-          pip install --root-user-action=ignore -r requirements.txt
-
-      - name: OpenAPI schema exports
-        env:
-          DB_TYPE: sqlite
-        run: |
-          python - <<'PY'
-          import json
-          from src.web_api import app
-          spec = app.openapi()
-          paths = sorted(spec["paths"])
-          required = {"/forecast", "/measurements/latest", "/measurements/history/{station_code}", "/stations", "/api/stats", "/health"}
-          missing = required - set(paths)
-          assert not missing, f"documented endpoints missing from the app: {missing}"
-          json.dump(spec, open("openapi.json", "w"), indent=1)
-          print(f"{len(paths)} paths; schema written to openapi.json")
-          PY
-
-      - uses: actions/upload-artifact@v3
-        with:
-          name: openapi-${{ github.run_number }}
-          path: openapi.json

.gitea/workflows/release.yml

@@ -1,314 +0,0 @@
-name: Release - Northern Thailand Ping River Monitor
-
-on:
-  push:
-    tags:
-      - "v*.*.*"
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Release version (e.g., v3.1.3)"
-        required: true
-        type: string
-
-env:
-  PYTHON_VERSION: "3.11"
-  REGISTRY: git.b4l.co.th
-  IMAGE_NAME: b4l/northern-thailand-ping-river-monitor
-  # GitHub token for better rate limits and authentication
-  GH_TOKEN: ${{ secrets.GH_TOKEN }}
-
-jobs:
-  # Create release
-  create-release:
-    name: Create Release
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITEA_TOKEN }}
-          fetch-depth: 0
-
-      - name: Get version
-        id: version
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
-          else
-            echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Generate changelog
-        id: changelog
-        run: |
-          # Generate changelog from git commits
-          echo "## Changes" > CHANGELOG.md
-          git log --pretty=format:"- %s" $(git describe --tags --abbrev=0 HEAD^)..HEAD >> CHANGELOG.md || echo "- Initial release" >> CHANGELOG.md
-          echo "" >> CHANGELOG.md
-          echo "## Docker Images" >> CHANGELOG.md
-          echo "- \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}\`" >> CHANGELOG.md
-          echo "- \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest\`" >> CHANGELOG.md
-
-      - name: Create Release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITEA_TOKEN }}
-        with:
-          tag_name: ${{ steps.version.outputs.version }}
-          release_name: Northern Thailand Ping River Monitor ${{ steps.version.outputs.version }}
-          body_path: CHANGELOG.md
-          draft: false
-          prerelease: false
-
-  # Build and test for release
-  test-release:
-    name: Test Release Build
-    runs-on: ubuntu-latest
-    needs: create-release
-    strategy:
-      matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12"]
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITEA_TOKEN }}
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip --root-user-action=ignore
-          pip install --root-user-action=ignore -r requirements.txt
-          pip install --root-user-action=ignore -r requirements-dev.txt
-
-      - name: Run full test suite
-        run: |
-          python tests/test_integration.py
-          python tests/test_station_management.py
-          python run.py --test
-
-      - name: Build Python package
-        run: |
-          pip install --root-user-action=ignore build
-          python -m build
-
-      - name: Upload Python package
-        uses: actions/upload-artifact@v3
-        with:
-          name: python-package-${{ matrix.python-version }}
-          path: dist/
-
-  # Build release Docker images
-  build-release:
-    name: Build Release Images
-    runs-on: ubuntu-latest
-    needs: [create-release, test-release]
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITEA_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ vars.WORKER_USERNAME}}
-          password: ${{ secrets.CI_BOT_TOKEN }}
-
-      - name: Build and push release images
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-          labels: |
-            org.opencontainers.image.title=Northern Thailand Ping River Monitor
-            org.opencontainers.image.description=Real-time water level monitoring for Ping River Basin
-            org.opencontainers.image.version=${{ needs.create-release.outputs.version }}
-            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITEA_TOKEN }}
-
-  # Security scan for release
-  security-scan:
-    name: Security Scan
-    runs-on: ubuntu-latest
-    needs: build-release
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITEA_TOKEN}}
-
-  # Test release deployment locally
-  deploy-release:
-    name: Test Release Deployment
-    runs-on: ubuntu-latest
-    needs: [create-release, build-release, security-scan]
-    environment:
-      name: testing
-      url: http://localhost:8080
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITEA_TOKEN }}
-
-      - name: Log in to Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ vars.WORKER_USERNAME}}
-          password: ${{ secrets.CI_BOT_TOKEN }}
-
-      - name: Deploy to production (Local Test)
-        run: |
-          set -euo pipefail
-          echo "🚀 Testing ${{ needs.create-release.outputs.version }} deployment locally..."
-
-          # Create a dedicated network so we can resolve by container name
-          docker network create ci_net || true
-
-          # Pull the built image
-          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}
-
-          # Stop & remove any existing container
-          docker rm -f ping-river-monitor-test 2>/dev/null || true
-
-          # Start the container on the user-defined network
-          docker run -d \
-            --name ping-river-monitor-test \
-            --network ci_net \
-            -p 8080:8000 \
-            -e LOG_LEVEL=INFO \
-            -e DB_TYPE=sqlite \
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}
-
-          echo "✅ Container started for testing"
-
-      - name: Health check after deployment
-        run: |
-          set -euo pipefail
-          echo "⏳ Waiting for application to start..."
-
-          # Pull a curl-only image for probing (keeps your app image slim)
-          docker pull curlimages/curl:8.10.1
-
-          # Helper: curl via a sibling container on the SAME Docker network
-          probe() {
-            local url="$1"
-            docker run --rm --network ci_net curlimages/curl:8.10.1 \
-              -sS --max-time 5 --connect-timeout 3 -w "HTTP_CODE:%{http_code}" "$url" || true
-          }
-
-          # Wait for /health (up to ~3m 45s)
-          for i in {1..15}; do
-            echo "🔍 Attempt $i/15: checking http://ping-river-monitor-test:8000/health"
-            resp="$(probe http://ping-river-monitor-test:8000/health)"
-            code="$(echo "$resp" | sed -n 's/.*HTTP_CODE:\([0-9]\+\).*/\1/p')"
-            body="$(echo "$resp" | sed 's/HTTP_CODE:[0-9]*$//')"
-            
-            echo "HTTP: ${code:-<none>} | Body: ${body:-<empty>}"
-            
-            if [ "${code:-}" = "200" ] && [ -n "${body:-}" ]; then
-              echo "✅ Health endpoint responding successfully"
-              break
-            fi
-            
-            echo "❌ Not ready yet. Showing recent logs…"
-            docker logs --tail 20 ping-river-monitor-test || true
-            sleep 15
-            
-            if [ "$i" -eq 15 ]; then
-              echo "❌ Health never reached 200. Failing."
-              exit 1
-            fi
-          done
-
-          echo "🧪 Testing API endpoints…"
-          endpoints=("health" "docs" "stations" "metrics")
-          for ep in "${endpoints[@]}"; do
-            url="http://ping-river-monitor-test:8000/$ep"
-            resp="$(probe "$url")"
-            code="$(echo "$resp" | sed -n 's/.*HTTP_CODE:\([0-9]\+\).*/\1/p')"
-            
-            if [ "${code:-}" = "200" ]; then
-              echo "✅ /$ep: OK"
-            else
-              echo "❌ /$ep: FAILED (HTTP ${code:-<none>})"
-              echo "Response: $(echo "$resp" | sed 's/HTTP_CODE:[0-9]*$//')"
-              exit 1
-            fi
-          done
-
-          echo "✅ All health checks passed!"
-
-      - name: Container logs and cleanup
-        if: always()
-        run: |
-          echo "📋 Container logs:"
-          docker logs ping-river-monitor-test || true
-
-          echo "🧹 Cleaning up test container..."
-          docker stop ping-river-monitor-test || true
-          docker rm ping-river-monitor-test || true
-
-          echo "📊 Deployment Test Summary:"
-          echo "Version: ${{ needs.create-release.outputs.version }}"
-          echo "Image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}"
-          echo "Status: Container tested successfully"
-          echo "Ready for production deployment"
-
-  # Notify stakeholders
-  notify:
-    name: Notify Release
-    runs-on: ubuntu-latest
-    needs: [create-release, deploy-release]
-    if: always()
-
-    steps:
-      - name: Notify success
-        if: needs.deploy-release.result == 'success'
-        run: |
-          echo "🎉 Release ${{ needs.create-release.outputs.version }} tested successfully!"
-          echo "🧪 Local Test: Passed all health checks"
-          echo "� GDocker Image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}"
-          echo "✅ Ready for production deployment"
-
-          # Add notification to Slack, Discord, email, etc.
-          # curl -X POST -H 'Content-type: application/json' \
-          #   --data '{"text":"🎉 Northern Thailand Ping River Monitor ${{ needs.create-release.outputs.version }} tested and ready for deployment!"}' \
-          #   ${{ secrets.SLACK_WEBHOOK_URL }}
-
-      - name: Notify failure
-        if: needs.deploy-release.result == 'failure'
-        run: |
-          echo "❌ Release ${{ needs.create-release.outputs.version }} testing failed!"
-          echo "Please check the logs and fix issues before production deployment."
-
-          # Add failure notification
-          # curl -X POST -H 'Content-type: application/json' \
-          #   --data '{"text":"❌ Northern Thailand Ping River Monitor ${{ needs.create-release.outputs.version }} testing failed!"}' \
-          #   ${{ secrets.SLACK_WEBHOOK_URL }}