webapp: configure rolling upgrade

and add probe to detect when gunicorn is ready
to accept requests (before killing the previous container)