fix SSL CA trust store for HTTPS in containers

Start a named Finch pool with CAStore certificate path and configure
Req to use it by default. Fixes integration sync failures on Dokku
where the OS CA trust store is unavailable.

config/config.exs

@@ -82,6 +82,9 @@ config :phoenix, :filter_parameters, [
 # Use Jason for JSON parsing in Phoenix
 config :phoenix, :json_library, Jason
 
+# Configure Req HTTP client to use our Finch pool with CA certs
+config :req, default_options: [finch: Towerops.Finch]
+
 # Configure tailwind (the version is required)
 config :tailwind,
   version: "4.1.12",

lib/towerops/application.ex

@@ -91,6 +91,19 @@ defmodule Towerops.Application do
         {Cluster.Supervisor, [topologies, [name: Towerops.ClusterSupervisor]]},
         ToweropsWeb.Telemetry,
         Towerops.Repo,
+        # HTTP client pool with CA certificate configuration
+        # Ensures HTTPS works in containers where OS CA store is unavailable
+        {Finch,
+         name: Towerops.Finch,
+         pools: %{
+           default: [
+             conn_opts: [
+               transport_opts: [
+                 cacertfile: CAStore.file_path()
+               ]
+             ]
+           ]
+         }},
         # Encryption vault for sensitive data (passwords, API tokens)
         Towerops.Vault,
         # Error notifications via email (production only, gracefully shuts down in dev/test)